Confirmed opt-in (COI), also called double opt-in, is a subscription process in which a person first enters an email address and then confirms the request from that mailbox, usually by clicking a unique link. Only after that second action should the address become eligible for ongoing marketing email.

Confirmed opt-in definition

A confirmed opt-in is a permission-based email signup method with two distinct actions. First, a person submits an email address through a form, checkout flow, account registration, event registration, or another consent collection point. Second, the sender sends a confirmation message to that address and requires an affirmative action—typically a click on a single-use confirmation link—before adding the person to the active marketing list.

The important word is confirmed. An address appearing in a form submission does not prove that the person owns the mailbox, intended to subscribe, or wants recurring promotional email. The confirmation step provides stronger evidence for all three:

The address can receive mail at the time of signup.
The person or someone with access to the mailbox saw the confirmation request.
The recipient took a deliberate action to activate the subscription.

Confirmed opt-in is commonly called double opt-in or DOI. The terms are generally used interchangeably in email marketing and deliverability discussions. “Two-step opt-in” is another understandable description, although it is less common terminology.

A confirmed opt-in process is most relevant to marketing, newsletters, product updates, event announcements, and other recurring communications. It is not normally necessary to send a receipt, password-reset link, security alert, or another transactional message that a customer specifically triggered. But if a transactional email also enrolls someone in promotional marketing, the promotional consent should be collected and recorded separately.

How confirmed opt-in works

The workflow is simple on the surface, but the implementation details determine whether it creates useful permission evidence and a good subscriber experience.

The basic two-step flow

A typical confirmed opt-in flow looks like this:

A visitor enters an email address and submits a signup form.
Your application records the request as pending rather than subscribed.
Your email infrastructure sends a confirmation email to that pending address.
The recipient clicks a unique confirmation URL, or completes another clear affirmative confirmation action.
Your application verifies the token, records the confirmation event, and changes the contact’s status to active.
The recipient sees a success page and, ideally, receives the promised content or a useful welcome email.

The essential operational rule is that a pending contact is not a marketing subscriber. Do not quietly add pending contacts to campaign audiences, automated newsletters, promotional sequences, or retargeting segments before they confirm.

What a good confirmation email contains

A confirmation message should make the purpose obvious without requiring the recipient to guess why it arrived. It should identify the brand, name the list or communication category, explain what will happen after confirmation, and include a prominent action button or link.

For example:

Confirm your subscription to the Acme product updates newsletter. Click the button below to receive product news, tutorials, and occasional offers at this address.

That wording is more useful than a vague “Please verify your email” notice. It tells a recipient what they are agreeing to receive, helps them spot an unwanted signup, and provides a clear record of the intended subscription scope.

A robust confirmation message also includes a plain-text link in addition to the HTML button. Some recipients read email in text-only clients, security tools may alter links, and buttons occasionally fail to render. A visible fallback URL improves accessibility and reduces avoidable confirmation friction.

What happens when a person does not confirm

If no confirmation occurs, leave the address in a pending state for a limited period and do not send recurring campaigns to it. You may send a carefully limited reminder if the original request was recent and your consent language supports that follow-up, but repeated reminders create the same unwanted-mail problem that confirmed opt-in is meant to prevent.

After the token expires, suppress, archive, or delete the pending request according to your retention policy. Keep only the records you can justify retaining, and avoid treating an unconfirmed form entry as permission later because the address reappeared in another data source.

Confirmed opt-in vs. single opt-in

With single opt-in, a person becomes subscribed immediately after submitting an email address. There is no requirement to click a confirmation link from inside the mailbox. The lower-friction experience can produce more nominal signups, especially when someone wants immediate access to a download, discount, or account feature.

With confirmed opt-in, the subscriber must complete a second action. That extra step introduces friction, so the total number of activated subscribers will usually be lower than the number of submitted forms. In return, the resulting list is usually more defensible and better qualified.

The trade-off in practical terms

Single opt-in optimizes for signup volume. Confirmed opt-in optimizes for confidence in list quality.

A single-opt-in form can collect addresses that are:

Misspelled by the person filling out the form.
Entered by bots or automated scripts.
Submitted by someone using another person’s address.
Temporary, disposable, or abandoned soon after signup.
Added by someone who wanted a one-time asset but did not understand the recurring email commitment.

A confirmation click does not eliminate every risk. It cannot prove the recipient is a real person, guarantee long-term engagement, or replace sound authentication and sending practices. However, it filters out many accidental, fraudulent, and low-intent signups before they reach your recurring campaign list.

When single opt-in may still be appropriate

Single opt-in can be reasonable when speed is central to the user experience and you have other reliable controls. A SaaS product might immediately send product onboarding information after a user has created an account, for example, while collecting separate marketing consent in the account settings. A retailer may also use a direct opt-in for a purchase-related preference program where the consent statement is clear and the risk of form abuse is low.

The right choice depends on your acquisition channel, the sensitivity of the communication, the expected volume, the likelihood of abuse, and the cost of adding poor-quality contacts to your list. There is no universal rule that every email program must use double opt-in. Still, confirmed opt-in is often the safer default for public newsletter forms, high-value promotions, co-marketing campaigns, and any source that attracts bot traffic or mistyped addresses.

Why confirmed opt-in matters for deliverability

Email deliverability is not simply whether an SMTP server accepts a message. It is the combined ability to reach the recipient’s inbox reliably while maintaining a trustworthy sending reputation. Mailbox providers evaluate many signals, including authentication, recipient engagement, complaints, message patterns, and the quality of the sender’s list-building practices.

Confirmed opt-in supports deliverability because it improves the quality of the audience before campaign sending starts. A recipient who actively confirmed is more likely to recognize the sender and less likely to report the first campaign as spam. An address that cannot receive the confirmation email never becomes an active subscriber, preventing it from contributing to later campaign bounces.

Fewer invalid addresses entering campaign audiences

A public signup form is an easy place for bad data to enter. A visitor may make a typo such as jane@gmial.com, a prankster may submit someone else’s email address, or a bot may flood the form with addresses. If all of those records become immediately active, the first newsletter campaign becomes a list-cleaning exercise performed at your sending domain’s expense.

A confirmation email places a meaningful gate in front of the active list. If the address is invalid, the confirmation message will fail or remain unconfirmed. If it belongs to someone who never signed up, that person can ignore it rather than receiving an ongoing campaign stream. If it was entered by a bot, the bot must also be able to access the mailbox and complete the unique confirmation action.

Lower complaint risk through clearer expectations

Spam complaints often begin with a recognition problem: “I do not know this sender,” “I never asked for this,” or “I did not expect messages this often.” Confirmed opt-in gives the recipient an opportunity to verify the relationship before marketing begins.

That does not make complaint prevention automatic. A subscriber can confirm a list in January and still complain in June if your content becomes irrelevant, your sending frequency increases, your From name changes, or your unsubscribe process is difficult. But confirmation creates a stronger starting point than an address that was silently added after a form submission.

For bulk senders, Gmail’s published sender guidelines emphasize authentication, low user-reported spam rates, and easy unsubscribing for applicable messages. Confirmed opt-in is not a substitute for those requirements, but it is a practical list-acquisition control that helps support the underlying goal: sending messages recipients actually want.

Better engagement signals over time

A confirmation click is an early expression of intent. It is not the same as a campaign click, and it should not be overinterpreted as proof of lifetime engagement. Still, a confirmed subscriber has already completed one meaningful interaction using the target mailbox.

That usually makes list segmentation more useful. You can distinguish among people who submitted a form, confirmed a subscription, opened a welcome email, clicked a campaign, purchased, or became inactive. Those distinctions make it easier to avoid sending the same campaign intensity to every address in the database.

Stronger operational evidence of permission

Deliverability teams, abuse desks, and internal compliance teams often need to answer a basic question: why did this person receive this email? A confirmed opt-in record helps answer that question with an event trail rather than an assertion.

A useful record includes the signup time, confirmation time, source form or collection point, consent language version, subscription category, IP address where appropriate and lawful, user agent where appropriate, confirmation token identifier, and the exact address that confirmed. Keep records securely, limit access, and apply a retention policy appropriate to your business and jurisdiction.

Is confirmed opt-in a metric?

Confirmed opt-in itself is a process, not a single deliverability metric. However, the process produces several important metrics. The most common is the confirmation rate, sometimes called double-opt-in conversion rate or opt-in completion rate.

Confirmed opt-in rate formula

The basic calculation is:

confirmed opt-in rate = confirmed subscriptions / signup requests × 100

The numerator should include only people who completed the confirmation event during the reporting cohort or defined attribution window. The denominator should include valid signup attempts for that same cohort, after excluding known internal testing and clearly fraudulent requests if your reporting rules define those exclusions in advance.

Worked numeric example

Suppose a newsletter form receives 2,400 signup requests during April. Of those requests, 1,680 recipients click the confirmation link before it expires.

confirmed opt-in rate = 1,680 / 2,400 × 100
confirmed opt-in rate = 70%

The confirmed opt-in rate for that April signup cohort is 70%.

That number does not mean 30% of the email addresses were invalid. Non-confirmation can happen for many reasons: a person changed their mind, the confirmation message went to spam, the call to action was unclear, the confirmation arrived too late, the address was mistyped, or the user did not notice it. To diagnose the result, examine the rest of the funnel.

Supporting metrics worth tracking

Measure more than one percentage. A healthy-looking confirmation rate can hide a delivery problem, while a low confirmation rate can be a form or user-experience problem rather than a consent-quality problem.

Track these metrics by acquisition source, device type, geography where relevant, and time period:

Confirmation-message delivery rate: confirmation messages accepted or delivered divided by messages attempted.
Confirmation-message bounce rate: bounced confirmation messages divided by messages attempted.
Time to confirm: median and percentile time from form submission to confirmation.
Token-expiration rate: pending signups that attempt confirmation after the token has expired.
Post-confirmation welcome engagement: opens, clicks, or downstream activation after confirmation, interpreted carefully because open tracking has limitations.
Complaint rate for confirmed cohorts: spam complaints divided by delivered marketing messages for subscribers who confirmed.
Source-level confirmation rate: confirmed subscriptions divided by signup requests for each form, partner, campaign, or landing page.

A sudden change is often more valuable than a universal benchmark. If your confirmation rate falls from 74% to 48% immediately after a new signup page launches, investigate the implementation. If confirmation-message bounces rise after a partner promotion, examine the source quality and the form validation rules.

Common causes of low confirmed opt-in rates

A low confirmation rate is a signal, not a diagnosis. Start by separating failures in message delivery from failures in recipient motivation or user experience.

The confirmation email never arrives promptly

The first requirement is obvious: the person must receive the confirmation request. Delays can cause a major drop-off because signup intent is strongest immediately after the form is submitted.

Check your sending logs for accepted, delivered, deferred, bounced, and suppressed events. Confirm that the sender domain is authenticated with SPF and DKIM, that the From domain is aligned appropriately with your email authentication approach, and that your sending domain has a stable reputation. For high-volume programs, technical compliance and list quality work together; neither is enough on its own.

A confirmation message should normally be sent immediately after the signup event. If a queue, webhook, background worker, or database transaction delays it by hours, many people will no longer remember the request or will have moved on.

The signup page does not set expectations

A person should know that a confirmation email is coming before they submit the form. If the button says only “Submit,” followed by a generic thank-you page, recipients may mistake the confirmation request for unrelated mail.

Set expectations in the form and the post-submit state. Tell the person what they will receive, how frequently you expect to send it, and that they must check their inbox to complete the subscription. If practical, include an instruction to check spam or promotions folders without encouraging recipients to misclassify messages.

The confirmation message is vague or looks suspicious

A confirmation email that lacks a recognizable brand, has a confusing sender name, or contains an unexplained link may look like phishing. The message should be concise, recognizable, and consistent with the signup page’s design and language.

Avoid loading the confirmation request with unrelated marketing copy, several competing calls to action, or aggressive urgency. Its job is to let the recipient verify a subscription request—not to conduct a full promotional campaign before permission is complete.

The link is broken, expired too quickly, or hard to use

Confirmation links need enough entropy to resist guessing, must be single-use or safely idempotent, and should expire after a reasonable period. An expiration window that is too short frustrates people who sign up during a busy workday and check email later. A window that never expires increases the chance that an old forwarding, shared inbox, or compromised link becomes an unintended subscription action.

When a link is clicked, handle common cases gracefully. If the person is already confirmed, show a clear success or “already confirmed” page. If the token expired, offer a straightforward way to request a new confirmation email. Do not return an unexplained server error or send the person back to a blank form.

Form abuse and bad acquisition sources

A public form without rate limits, bot controls, or server-side validation can attract automated submissions. A low confirmation rate from one landing page or affiliate source may reflect incentive abuse rather than a broad deliverability problem.

Review acquisition sources separately. If a sweepstakes page produces a 25% confirmation rate while your documentation newsletter produces 81%, do not average the issue away. Tighten controls on the problematic source, revisit its incentive language, and consider whether the source is worth keeping.

The email address is malformed or disposable

Basic client-side validation improves the form experience, but it is not a complete data-quality control. Server-side validation should check for obvious syntax errors and should not rely solely on browser validation. Address verification at the point of capture can further reduce avoidable confirmation-message bounces; a free email address verification tool can help teams examine questionable addresses before they affect a campaign audience.

Be careful not to reject legitimate addresses merely because they look unusual. Internationalized addresses, plus addressing, and uncommon but valid top-level domains can all be legitimate. The goal is to reduce clear errors and abuse without building an overaggressive gate that blocks real subscribers.

How to implement confirmed opt-in safely

A confirmed opt-in flow touches your form, database, sending system, event tracking, and consent records. Treat it as an application feature with security and reliability requirements, not just an email template.

Use explicit subscriber states

Model subscriber status clearly. A minimal state model might include:

pending: submitted a signup request but has not confirmed.
active: confirmed and eligible for the specified marketing category.
unsubscribed: opted out of that category or all marketing.
suppressed: should not receive mail because of a hard bounce, complaint, legal request, or internal policy.
expired: pending confirmation lapsed without completion.

Do not use a simple true-or-false subscribed field if your program needs reliable lifecycle reporting. Explicit states reduce the chance that an import, retry job, or campaign query accidentally includes pending addresses.

Generate secure confirmation tokens

Use cryptographically secure, high-entropy tokens generated on the server. Store a protected representation of the token where practical, associate it with a specific address and subscription purpose, set an expiry time, and invalidate it after successful use.

Do not use predictable values such as a sequential customer ID, a plain email address, or a trivially encoded timestamp. A confirmation endpoint should verify the token, apply the correct state transition, and log the event without exposing account data in a URL or page response.

Make confirmation idempotent

People double-click. Security scanners may follow links. Email clients can prefetch or inspect URLs. Your confirmation endpoint should tolerate safe repeat requests without creating duplicate contacts, sending duplicate welcome sequences, or displaying errors after the first legitimate confirmation.

Where automated link scanning is a concern, consider a flow that displays a confirmation page and requires a final deliberate button press. That adds friction, so evaluate it against your threat model and confirmation completion rate. The important point is to distinguish a human’s affirmative action from an accidental or automated request when your environment requires that protection.

Separate marketing consent by purpose

Someone who signs up for a monthly engineering newsletter has not necessarily consented to product announcements, partner promotions, event invitations, or regional offers. Record the subscription purpose and preferences at confirmation time.

This improves both compliance posture and campaign performance. Recipients are less likely to disengage or complain when the content matches the commitment they saw at signup. A preference center can let active subscribers adjust topics or frequency without requiring an all-or-nothing unsubscribe decision.

Test the entire path

Before launch, test more than the form submission. Submit valid and invalid addresses, use major mailbox providers, test on mobile, inspect the plain-text version, click the token twice, wait for expiry, request a new token, and test the already-subscribed state.

Also test operational failures: a sending-provider timeout, a database rollback after the email is queued, a webhook arriving twice, an unsubscribe before confirmation, and a confirmation from an address that has become suppressed. Your email API setup guides should support a clear separation between the application event that requests a confirmation email and the event that activates a subscription.

How to improve a confirmed opt-in program

Improvement should not mean weakening confirmation merely to raise the completion percentage. The objective is to make the legitimate path easy while preserving the evidence and quality benefits of the second step.

Reduce friction before the confirmation email

Use a short signup form. For a newsletter, an email address may be all you need at first. Every extra field can reduce submissions and can distract from the forthcoming confirmation instruction.

Use clear consent language near the submit button. Identify the sender, describe the content category, state expected frequency if known, and link to relevant privacy information. Avoid prechecked boxes for optional promotional consent where they may confuse users or create weak evidence of intent.

Optimize the post-submit page

The page immediately after form submission is part of the confirmed opt-in flow. It should say that the request is not complete yet, repeat the destination address in a privacy-conscious way when appropriate, and tell the person what email to look for.

A useful post-submit message might say:

One more step: check your inbox for a message from Acme and select “Confirm subscription.” You will not receive the newsletter until you confirm.

This wording helps prevent confusion without implying that an address has already joined the list.

Keep the confirmation email focused

Use one primary action. Make the subject specific, such as “Confirm your Acme Weekly subscription,” rather than “Important action required.” Ensure the From name is recognizable, and keep the message visually close to the signup experience.

Send the promised asset after confirmation, not instead of confirmation. If you offer a guide, discount, or template as an incentive, make the path clear: confirm the subscription, then access the item. This reduces the temptation to activate everyone immediately just to fulfill the offer.

Segment and investigate by source

Do not rely on an account-wide confirmation rate alone. Compare signup sources, campaigns, form variants, countries, devices, and mailbox domains. A source that produces a high volume of pending records but weak confirmation may be misleading people, attracting bots, or offering an incentive that does not match the email program.

Use those findings to improve the actual source. Rewrite the ad, change the form language, add rate limiting, remove a low-quality partner, or adjust the offer. Better acquisition produces benefits that extend beyond the confirmation rate, including fewer bounces, stronger engagement, and less list-cleaning work later.

What confirmed opt-in does not solve

Confirmed opt-in is a valuable list-building control, but it is not a complete deliverability strategy.

It does not configure SPF, DKIM, or DMARC. It does not create correct reverse DNS, fix poor message formatting, provide one-click unsubscribe, or guarantee that a mailbox provider places every message in the inbox. It also does not eliminate the need to monitor bounces, complaints, unsubscribes, delivery failures, or changing recipient engagement.

It does not make old consent permanent either. A person may have actively confirmed years ago but no longer recognize your brand or want your messages. Continue to honor unsubscribes promptly, monitor inactivity, use sensible re-engagement practices, and suppress recipients whose behavior or mailbox events indicate that continued sending is unwelcome.

Finally, confirmed opt-in is not a substitute for legal analysis. Consent and recordkeeping obligations vary by jurisdiction, message type, recipient relationship, and data-processing context. Get appropriate legal guidance for your specific program, especially when sending internationally or handling sensitive categories of personal data.

Confirmed opt-in checklist

Use this checklist when designing or auditing a confirmed opt-in workflow:

Collect a clear, purpose-specific signup request.
Store the new request as pending, not active.
Send the confirmation message promptly from a recognizable, authenticated domain.
State what the subscriber is confirming and what messages they can expect.
Use a secure, unique, expiring confirmation token.
Include a prominent button and a working plain-text fallback link.
Activate the subscription only after the intended affirmative action.
Record signup, confirmation, consent language, source, and subscription category.
Keep pending contacts out of marketing campaigns.
Handle expired, repeated, and already-used links gracefully.
Track confirmation rate, confirmation-message bounces, time to confirm, and source quality.
Continue to provide easy unsubscribe and maintain normal deliverability hygiene after confirmation.

Conclusion

Confirmed opt-in is a two-step permission process that turns a raw email form submission into a more trustworthy marketing subscription. By requiring a recipient to confirm from the mailbox itself, it helps filter typographical errors, unauthorized signups, bot submissions, and low-intent contacts before they affect campaign performance.

The trade-off is intentional: a second action reduces immediate list growth, but it can improve the quality, defensibility, and long-term usefulness of the subscribers who remain. Implement it with a fast confirmation message, clear expectations, secure tokens, accurate consent records, and active monitoring. Then treat it as one component of a larger email program built on authentication, relevant content, responsible frequency, and easy opt-out.

FAQ

Is confirmed opt-in the same as double opt-in?

Yes. Confirmed opt-in and double opt-in usually describe the same two-step process: a person submits an address, then confirms the subscription through a message delivered to that address.

Does confirmed opt-in guarantee inbox placement?

No. It can improve list quality and reduce avoidable complaints or bounces, but inbox placement also depends on authentication, sender reputation, content, recipient engagement, complaint rates, unsubscribe handling, and mailbox-provider filtering.

What is a good confirmed opt-in rate?

There is no universal target because rates vary by source, incentive, audience, device, confirmation-email delivery, and form design. Track your own rate by signup source and investigate material changes. A sudden decline is usually more actionable than comparing one program with an unrelated industry average.

Can I send a reminder to someone who did not confirm?

Usually, one timely and clearly related reminder can be reasonable when it follows a recent signup request. Avoid repeated reminders or promotional campaigns to unconfirmed addresses. If the recipient does not confirm, let the pending request expire according to your policy.

Should transactional email use confirmed opt-in?

A customer-triggered transactional message such as a password reset or receipt does not normally require marketing confirmation. However, do not use a transactional action to silently subscribe someone to promotional email. Collect and record marketing consent separately when needed.

Confirmed Opt-In: What It Means for Email Deliverability