Double opt-in vs single opt-in: what confirmation costs, and why it wins

Single opt-in puts an address on your list the moment someone types it into a form. Double opt-in — confirmed opt-in, in the language of the people who write the standards — puts it on your list only after the person proves they can read that inbox, by clicking a link or entering a code that was mailed to it.

Use double opt-in. It will hand you a smaller list, it will lose you signups on the day, and it is still the right default, for reasons that are mechanical rather than moral. The exception is at the bottom of this page.

What each one actually does

Single opt-in is one step. The form submits, the row gets written, the welcome email goes out — sometimes to an address that has never existed. You find out it never existed when your sending provider reports the bounce, which is after the send, which is after the harm.

Double opt-in is two. The form submits, the address waits in a pending state, a message goes to it, and only someone holding that inbox can move it onto the list. Everything that was going to fail fails at this step instead, before the address is on the list, where failing costs nothing.

That's the whole structural difference: single opt-in finds bad addresses by mailing them, double opt-in finds them by not being able to.

The comparison

Confirmation loses you signups. Be honest about which ones

Say a hundred people submit the form and eighty confirm. You didn't lose twenty readers. You lost twenty rows, and the rows that go missing are not a random sample of the hundred.

They cluster. The address one letter off a real provider. The one somebody invented because they wanted the file and not the relationship. The work address of a person who lives in a different inbox. The mailbox at a domain that stopped resolving when the company folded. Every one of those would have sat on your list for years, been mailed for years, and opened nothing.

Some of the twenty are real, though, and it's worth saying so plainly. A confirmation mail lands in Promotions. A phone locks. A tab gets closed. Those are people who wanted what you had and didn't get it, and no argument about list hygiene turns that into a win. What it turns it into is a design problem: the shorter the gap between submitting and confirming, the fewer of them you drop.

You don't need anyone else's benchmark here. Divide confirmations by submissions on your own form and you have the only number that describes your audience. Watch it move when you change the confirmation email, the sending domain, or the screen that tells people to go and check their mail.

The bill for a bigger list arrives at the mailbox provider

Gmail, Outlook and the rest decide whether your mail reaches an inbox based on how your previous mail behaved. A list assembled without confirmation degrades every input they look at.

• Hard bounces. Mail to addresses that don't exist is the signature of a scraped or bought list, because that's usually where it comes from. Providers answer with throttling, then filtering, then refusal.
• Complaints. An address typed one character wrong often belongs to somebody real. They never asked for anything, so they press the spam button, and their complaint counts the same as any other.
• Engagement. Opens, clicks, replies and deletes all get weighed. Addresses nobody reads contribute the "nobody read it" half and nothing else, dragging down the average for the readers you do have.
• Recycled traps. Abandoned mailboxes get repurposed as spam traps. An unconfirmed list accumulates abandoned mailboxes by design, because nothing on it ever had to be alive.

The part that catches people out is that this reputation attaches to your sending domain, not to your newsletter. Damage it with a marketing blast and your password resets, receipts and invoices go to spam alongside it. The list you built for growth can take down the mail your business runs on.

There's also an abuse case that only works against single opt-in. A form that adds an address without confirming it is a free mailer: point a script with ten thousand harvested addresses at it, and your infrastructure sends ten thousand unsolicited welcome emails over your domain and collects the complaints for them. Confirmation makes the form useless for that, because nothing goes anywhere until a human proves they hold the inbox.

The one case where single opt-in is defensible

When the inbox has already passed the same test somewhere else.

A customer who completed a purchase got a receipt and acted on it. Someone who reset a password got the link and clicked it. An employee is in a directory you administer. In each case a message has already been delivered to that address and produced a response, which is exactly what a confirmation email tests. Asking for a second proof of something you already hold is friction with no return.

The boundary matters. That proof covers the address, not the permission. "Their receipt arrived" is not "they asked to hear from you every Thursday", and quietly moving checkout addresses onto a marketing list is the behaviour that produced the spam button in the first place. Keep the tick box, keep the record of it, and keep the two lists apart.

The usual excuses aren't this case. "Our audience is technical" doesn't test an inbox. Neither does a honeypot field, a CAPTCHA or a regex — those test the submission, and the submission was never the thing in doubt.

A code beats a link

Classic double opt-in has one design flaw, and it's why people give up on it: it interrupts. Somebody is on your page wanting your file, and you send them to a different application to look for a message that may not have arrived yet. Whether they come back is now a question about their attention, not their interest.

A six-digit code fixes the flow without weakening the check. The reader stays on the page, the code arrives, they type it in, and the thing they came for starts downloading. Nobody has to be talked into confirming, because confirming is how they get the file. Same proof, no round trip.

That's how Replilo works. A share link at replilo.com/s/<slug> asks for an email. Before any code goes out, the domain is checked against a mirrored public blocklist of disposable providers and its DNS is checked for MX and SPF records — what those DNS records prove and what they don't is worth reading if you're building this part yourself. Enter the code and the download starts; you now have a verified subscriber. Access is remembered per link, so a returning reader just gets the file.

The rest is link management: an expiry date, a download cap, a custom slug, a pause switch. A signed subscriber.verified webhook fires the moment an address is confirmed, and it can be forwarded into a spreadsheet when that's where the list really lives. The longer walkthrough is in our guide to putting a PDF behind a signup wall.

The short version

Single opt-in optimises the number on the dashboard. Double opt-in optimises the number of people who receive what you send. Confirmation costs you the signups that were never going to open anything, plus a few that would have, and it buys you a sending reputation that keeps the rest of your mail out of the spam folder. Skip it only when the address has already proved itself through an order or a login — and even then, don't mistake a working address for permission.