emailrules.today
Stop 1 of 8WorkingWeeks or years earlier

Double opt-in

The person confirms their email via a link before you add them to marketing — stronger proof they meant to join.

Say it out loud

We email them once to check the address is really theirs before we ever market to them.

Double opt-in (also called confirmed opt-in) means that after someone submits an address, nothing marketing-related is sent until they click a confirmation link. It is the strongest ordinary evidence of consent, and it quietly filters out typos, bots and people signing up their colleagues.

In your dataThe two rows that matterExample numbersscrolls →
signup 2026-03-04T14:22:07Z form=footer_newsletter
confirmed 2026-03-04T14:24:51Z ip=203.0.113.44

Two minutes and forty-four seconds later. That gap is the evidence: a human read an email and acted.

unconfirmed after 14 days → delete, do not "try again"

An address that never confirmed is either a typo or someone else's. Both are liabilities.

The confirmation timestamp is the single most useful field in a consent argument, because a machine cannot produce it and a person cannot forget it.

Yours

Nobody does this for you.

What goes wrong

Sending the confirmation email and, when it is not clicked, adding the person anyway on the grounds that they clearly meant to. That is worse than single opt-in: you now have a documented record of someone declining to confirm.

What people get told

The claim. Double opt-in costs you half your list.

Actually. It removes the half that was never going to engage, plus the typos and the bots. The measurable effects are lower bounces, lower complaint rate and fewer spam-trap hits — which is to say, the three things that decide whether the rest of the list arrives at all.

The dated rules behind this

A definition is not a citation. These are the pages with the primary source, the date it was published, and what to do about it.

See also

Where this sits

Stop 1, you get the address. Someone hands you an email address, and the terms of that handover decide everything after it.

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.