Double opt-in (also called confirmed opt-in) means a new subscriber enters their email address and then has to click a link in a confirmation email before you add them to your list. Single opt-in adds them as soon as they submit the form. Double opt-in produces a smaller but cleaner list, because typos, fake addresses, and addresses entered by someone else never get confirmed; single opt-in grows faster but lets those bad addresses in.

Which one you should use depends on where your signups come from and how much risk your sending reputation can absorb. Here’s how they compare and what the major mailbox providers and industry groups actually recommend.

How double opt-in works

A visitor enters their email address in your form.
The page tells them to check their inbox for a confirmation email.
You send one simple message with a “Confirm my subscription” link.
They click. Only now are they added to your marketing list, and you record the time, IP address, and form they used.
If they never click, they never receive marketing email from you.

How single opt-in works

A visitor enters their email address.
They’re added to your list immediately.
Usually they get a welcome email, and marketing starts.

M3AAWG, the industry anti-abuse working group whose members include mailbox providers and email senders, splits this into two levels in its Sender Best Common Practices (version 4.0, updated August 2026):

Level	What happens	M3AAWG label
Single opt-in	Address added, no notification, no confirmation	Use with extreme caution
Single opt-in with notification	Address added, welcome/notice message sent, no confirmation required	Better
Confirmed opt-in (double opt-in)	Address added only after the subscriber takes an action such as clicking a link	Best

For the middle level, M3AAWG recommends sending the notification immediately or as soon as possible, within 24 hours, and removing addresses whose notification bounces.

Double opt-in vs single opt-in: side-by-side comparison

Factor	Single opt-in	Double opt-in
Signup friction	One step	Two steps (form + email click)
List growth	Faster	Slower; some people never confirm
Typos and fake addresses	Get onto the list	Filtered out, because they can’t confirm
Addresses entered by someone else	Get onto the list	Filtered out
Bot and list-bombing signups	Get onto the list and trigger mail	Limited to one confirmation message each
Hard bounce rate	Higher	Lower
Proof of consent	Form submission record	Form submission plus confirmation click
Spam trap risk	Higher, especially from bots and typo domains	Lower

The core difference is that double opt-in proves the address works and that the person behind it wanted to join. Single opt-in proves only that someone typed something into your form.

What Gmail, Yahoo, and AWS say about confirmed opt-in

None of the major providers forbid single opt-in, but their guidance points the same way:

Google tells senders to confirm each recipient’s email address before subscribing them and to make sure recipients opt in.
Yahoo recommends using double or confirmed opt-in to reduce invalid recipients, and says not to subscribe users through a pre-checked opt-in box.
Amazon SES recommends implementing a double opt-in strategy and not emailing new signups until they click the confirmation link, noting that it helps reduce hard bounces caused by typos. When SES flags an account for spam trap hits or complaints, its remediation guidance again recommends double opt-in and sending only to addresses that completed it.

Is double opt-in legally required in the US?

No. CAN-SPAM, the main US law for commercial email, is built around opting out rather than opting in. The FTC’s compliance guide focuses on accurate headers, honest subject lines, a physical address, and a working opt-out honored within 10 business days. It doesn’t require prior consent or a confirmation step.

Other regions are stricter about consent, if not about double opt-in specifically. Under the EU’s GDPR, when consent is your legal basis, Article 7 says you must be able to demonstrate that the person consented, and withdrawing consent must be as easy as giving it. A confirmation click with a timestamp is one of the clearest records you can have. For what to keep and for how long, see consent, records and the rules that outlive your list.

This isn’t legal advice. If you mail people in the EU, UK, or Canada, check the rules that apply to you with counsel.

When single opt-in is reasonable

Double opt-in isn’t automatically the right answer for every form. Single opt-in can work when:

The address is already verified another way. A customer who just received a password reset or order receipt at that address has effectively proven it works.
The signup is part of a transaction. Checkout or account creation, where the person has a reason to enter their real address and you’ll send transactional mail anyway.
You validate hard at the form. Syntax, domain, MX, typo, and disposable-domain checks remove most junk, though not addresses that belong to someone else.
Your traffic is low-risk. No paid lead-gen incentives, no giveaways that attract fake entries, and bot protection on the form.

If you choose single opt-in, at least move up to M3AAWG’s “with notification” level: send a welcome message right away, and remove the address if it bounces.

When double opt-in is the better choice

Contests, giveaways, and lead magnets. Incentives attract fake and throwaway entries.
Forms that have been abused. AWS’s guidance on list bombing, where attackers submit many addresses through web forms, recommends a CAPTCHA plus a confirmation email.
Offline or co-registration sources. Event badge scans, paper forms, and partner sign-ups all have high typo and misattribution rates.
You’ve already had deliverability trouble. If your provider has warned you about bounces, complaints, or traps, confirmed opt-in is one of the first fixes they’ll ask about.
You send to EU residents and want strong evidence of consent.

How to set up double opt-in without losing too many subscribers

Some people never click the confirmation link. You can reduce that loss without weakening the process:

Say what happens next on the form. “Check your inbox to confirm” on the thank-you page, with the address they entered shown so they can spot a typo. M3AAWG recommends telling users at submission that they’ll need to act on the confirmation email.
Send the confirmation instantly. Delays mean people forget.
Keep the confirmation email plain. M3AAWG advises keeping it simple and free of advertising so it isn’t filtered. One clear button, your brand name, and a sentence explaining why they got it.
Use a recognizable From name that matches the site they just visited.
Offer a resend link on the thank-you page.
Send one reminder to unconfirmed addresses after a day or two, then stop. Never add unconfirmed addresses to marketing sends.
Validate at the form first. Catching gmial.com before submission saves a confirmation that would never arrive. You can see what those checks look like by testing a few addresses with our free email verifier, which checks syntax, domain and MX records, disposable domains, role accounts, and common typos without contacting the mailbox.
Reconfirm when the address changes. M3AAWG says a subscriber’s updated address should be confirmed the same way.

Measure your confirmation rate

Track confirmations against submissions per form:

=IFERROR(COUNTIF(C2:C1000, "confirmed") / COUNTA(B2:B1000), 0)

where column B holds submitted addresses and column C holds status. A form with a much lower rate than the others is often being hit by bots or attracting low-intent signups, which is exactly what double opt-in is protecting you from.

Double opt-in and list hygiene

Double opt-in solves the intake problem. It doesn’t stop the list from decaying afterward. People still change jobs and abandon inboxes, so you’ll still need bounce suppression and periodic cleanup. See email list hygiene for the ongoing side, and real-time email verification for signup forms for the checks to run before the confirmation email even goes out.

FAQ

What is double opt-in in email marketing?

It’s a signup process where the subscriber must click a link in a confirmation email before being added to your list. It’s also called confirmed opt-in. It proves the address works and that its owner wanted to subscribe.

Does double opt-in improve deliverability?

It helps, because it keeps typos, fake addresses, and bot signups off your list, which lowers hard bounces and spam trap risk. Gmail, Yahoo, and Amazon SES all recommend confirming addresses for that reason.

CAN-SPAM doesn’t require any opt-in. GDPR doesn’t name double opt-in specifically, but it requires you to be able to demonstrate consent when consent is your legal basis, and a confirmation click is strong evidence.

Should I switch my existing list to double opt-in?

You don’t need to re-confirm everyone at once. Turn on double opt-in for new signups, and use a re-engagement or permission pass for older, less active segments where consent records are weak.

Double Opt-In vs Single Opt-In: Which Should You Use?