Double Opt-In Is a Deliverability Control
Double opt-in — where someone who fills in your form has to click a link in a confirmation email before they are really on your list — is usually explained as a compliance measure. Tick the box, satisfy the Spam Act, move on.
That framing undersells it badly, and it is why a lot of Australian small businesses skip it. Consent is a legal obligation you can meet other ways. Deliverability is an operational constraint you cannot negotiate with, and double opt-in is the cheapest lever you have on it.
We rolled it out across five of our sites on 25 September. Here is the reasoning, and the failure it immediately exposed.
The thing most people miss about sender reputation
Mailbox providers do not evaluate your marketing email separately from your transactional email. They evaluate your domain and sending infrastructure.
That means the reputation you build sending a monthly newsletter is the same reputation carrying your quotes, your invoices, your booking confirmations and your replies to enquiries. There is one score, and everything you send draws on it.
Now consider what an unverified list does to that score. When someone fills in a form with a typo — gmial.com, a transposed letter, an address that simply does not exist — and you send to it, you get a hard bounce. When someone types a colleague’s address, or a fake one to get a download, and you send to it, you get either a bounce or a spam complaint. Both are counted against you.
The thresholds are tighter than most people expect. Google and Yahoo’s bulk-sender requirements put the spam complaint rate that gets you throttled at 0.3%, which is three complaints in a thousand. Bounce rates above a couple of per cent start affecting placement. These are not large numbers, and a form with no verification step will find them.
The consequence is not that your newsletter stops arriving. It is that one day a client says they never got the quote, and the reason is a list you were not really using anyway.
What consent actually requires here
Worth being precise, because this is where the compliance framing does real harm.
Under Australian spam law, consent can be express or inferred, and a confirmation click is not the only way to establish it. A well-designed single opt-in with a clear statement of what you will send, records kept, and a working unsubscribe is a defensible position.
So if you are choosing double opt-in only to satisfy the law, someone will eventually point out that you did not have to, and they will be right. Choose it because it keeps your sending domain clean. The consent record is a genuine benefit that comes along with it — an audit trail showing the person clicked a link sent to their own mailbox is about as strong as consent evidence gets — but it is the second reason, not the first.
What we built
Every form on all five sites now runs the same sequence: the address is checked against a verification service before anything is stored, the contact is created in our CRM tagged unverified, and a branded confirmation email goes out. Clicking the link tags them verified and stamps the time. Nothing marketing-related sends to a contact that has not clicked.
Three design details are doing most of the work.
The address is checked before the first send, not after the first bounce. A verification service catches typos, disposable domains and non-existent mailboxes at submission time. This matters because the bounce you avoid is a bounce that never gets counted against you. Cleaning a list after the damage is done does not undo the damage.
The confirmation link is signed and bound to the address. The token is an HMAC signature covering the contact, the brand, an expiry, and a short hash of the lowercased email address. Because the address is inside the signature, the link cannot be replayed for a different contact. It expires after seven days. There is a ten-minute cooldown before a resend, so the confirmation endpoint cannot be used to hose someone’s inbox.
Each brand sends its own email. Five sites, five templates. Someone who filled in a form on the Cosmos site gets something that looks like Cosmos. Confirmation emails have unusually high open rates because the recipient is expecting them — sending one that looks like it came from a company they have never heard of converts that advantage into a spam complaint.
★ Insight ─────────────────────────────────────
The security property that makes a signed token work is not the signature by itself — it is what the signature covers. A token signing only a contact ID lets anyone who can guess a neighbouring ID confirm somebody else’s address. Putting a hash of the email inside the signed body means the link is only valid for the mailbox it was delivered to, which is exactly the claim a confirmation is supposed to prove.
─────────────────────────────────────────────────
The failure it exposed on day one
During testing, the confirmation email on one of the five sites landed in Spam.
This is the risk of double opt-in stated plainly, and anyone recommending it without mentioning this is selling you something. The flow has a new, silent failure mode: the person fills in your form, never sees the confirmation, and sits in your CRM marked unverified forever. You have not gained a clean list. You have gained a list of people who tried to contact you and got no response.
The cause is almost certainly authentication. Our sending domain’s DNS records — the ones that tell mailbox providers this infrastructure is allowed to send on our behalf, and what to do when something fails that check — were not fully in place. If you are going to run double opt-in, SPF, DKIM and DMARC are prerequisites, not follow-ups. The confirmation email is the one message in the whole funnel that absolutely must arrive.
Two mitigations, in the order we are doing them:
- Fix the DNS records. This is the actual fix and everything else is a workaround.
- Say “check your spam or promotions folder” in every form’s success message. Unglamorous, costs nothing, and recovers a meaningful share of the confirmations that go astray. Most businesses skip this because it feels like admitting a flaw. It is worth far more than it costs in polish.
A third is worth planning for: a report showing contacts who have been unverified for more than a few days. Without it, the failure is invisible — the people it affects are by definition not in your marketing list, so they never show up in any marketing number you look at.
Where the line sits
Not every form needs this. A contact form where a human reads the submission and replies personally does not — the reply itself is the verification, and adding a click between a customer and a response is friction that costs you work.
The line is whether the address will be sent to automatically, later, without a person deciding to. The moment a form feeds a sequence, a newsletter or a nurture campaign, the addresses it collects are drawing on the same reputation your invoices use, and they should have to prove they exist first.
Cloud Geeks runs email infrastructure, DNS and cloud systems for Australian small businesses. Websites and forms are built by Cosmos Web Tech, apps by Awesome Apps, and the group is Ganda Tech Services.