Double opt-in
Nobody joins your list until they click a confirmation link you email them, so every subscriber proved the inbox is really theirs.
See it
What it is
With double opt-in, typing an address into your signup form does not subscribe anybody. It sends one confirmation email, and only the click on that link adds the subscriber. Single opt-in trusts the form; double opt-in trusts the inbox. The click is also your consent receipt: timestamp, IP, and user agent, which is exactly what you want on file when someone claims they never signed up.
Reach for it on anything broadcast: newsletters, product digests, drip sequences, lead magnets. It is close to mandatory if your form is public and unprotected, because bots and bored people type other people's addresses into open forms, and every one of those becomes a complaint or a spam trap later. It is the single cheapest thing you can do for sender reputation on a new domain.
Yes, it costs you subscribers, usually 15 to 30 percent of raw signups. That is the point: the people who vanish were never going to open anything. Two practical notes. The confirmation email itself has to reach the inbox, so send it instantly, make the subject boring and literal ('Confirm your subscription'), and keep it plain. And do not confuse it with email address verification at account signup: verifying proves someone controls an inbox, double opt-in records permission to market to it. Store them as two separate facts.
Ask AI for it
Implement double opt-in for our newsletter signup. On submit, create the subscriber with status 'pending' and never mail them anything else, then send one plain confirmation email containing a link with a random single-use token (store only its hash, expire in 7 days). When the link is opened, show a confirmation page with a button and flip status to 'confirmed' on the POST, recording confirmed_at, IP, and user agent as the consent record. Handle expired or reused tokens with a 'resend confirmation' path, rate limit resends per address, purge pending subscribers after 14 days, and keep the confirmation subject literal ('Confirm your subscription') with no images or marketing copy.