- Single opt-in, defined
- Single opt-in adds a subscriber to your list the moment the form is submitted, with no confirmation step, so the address enters your database unproven.
The appeal is honest: every signup counts, nothing is lost to an unopened confirmation, and the list grows measurably faster. For a low-risk newsletter with a well-behaved audience that trade can work out.
What you inherit is everything the form was given. Mistyped addresses, competitor mischief, and whatever a bot filled in while harvesting your page.
The risk concentrates where you would expect. Hit a spam trap through an unconfirmed form and the provider sees mail arriving at an address nobody could have subscribed, which is the exact pattern they are watching for.
If you stay on single opt-in, verify at the point of entry and sunset aggressively afterwards. Those two habits recover most of the safety the confirmation click would have bought.
How ZapBounce reports it
Single opt-in is where real-time verification earns its keep, so our API is built to answer in one call while a visitor waits. The result tells you the mailbox is reachable, which is the part a form can check.
Sixty dead addresses a month, by arithmetic
Say your store's checkout and footer forms bring in 2,000 new addresses a month with no confirmation step. Assume 3% of people mistype, which is easy to do on a phone keyboard. That's 60 addresses a month that were never going to work. Each one gets a welcome email, and each welcome email bounces.
Sixty bounces against 2,000 welcomes is a 3% bounce rate on that stream alone. Welcome messages also tend to go out from the same domain as your order confirmations. The stream most exposed to bad input is sitting next to the mail your customers need most.
Over a year that's around 720 dead rows, plus whatever bots contributed. None of it shows up as a crisis. It shows up as a welcome series whose numbers are a bit worse every quarter, and nobody can point to what changed.
Where skipping the click is reasonable, and a middle path
Some addresses arrive with their own proof. A customer who just paid you typed that address expecting a receipt, and a logged-in user changing notification settings has already shown they control the account. Asking either of them to confirm again adds friction and tells you nothing new.
The risky case is an open form on a public page, because anyone can type anything into it. If you won't add a confirmation step there, you can get part of its effect from behavior. Treat the first three emails as a probation period. Anyone who opens or clicks during it is confirmed by their actions, and anyone silent after 30 days gets dropped.
Probation has one weakness you should know about. Apple's Mail Privacy Protection loads images automatically, so some opens are recorded by a machine. Count clicks as the stronger evidence, and put a link worth clicking in the welcome email.
Single opt-in: common questions
Is single opt-in legal?
In the United States under CAN-SPAM, yes. Under GDPR you still need demonstrable consent, and a bare form submission is thinner evidence than a confirmation click.
How do I make single opt-in safer?
Verify at the form, add a honeypot field, and sunset addresses that never engage. Those three cover most of the gap.
Which produces better engagement?
Confirmed lists engage better per subscriber because the confirmation filtered out everyone who was not paying attention.