KaiMail's public subscribe pages use a two-step confirmation flow. The visitor enters their address and clicks Subscribe, then later clicks a link in an email, and finally presses a Confirm subscription button on a web page.
Most services confirm the subscription as soon as the email link is clicked. We do not. Here is why.
Corporate email security products — Microsoft Defender for Office 365 Safe Links, Proofpoint, Barracuda, and others — automatically fetch every URL in incoming messages to check for threats. They do it at delivery time, before a human has even opened the email.
If confirmation happened on a plain page load, the scanner would confirm the subscription on the subscriber's behalf. You would end up with a "confirmed" address that no human ever agreed to. That is precisely the thing double opt-in exists to prevent.
By requiring a button press on the confirmation page, an automated fetcher landing on that page changes nothing. It sees a page. It does not press buttons.
The flow looks like this:
[email protected], DKIM-signed by kaimail.net)Step 6 is the critical difference. A scanner can fetch step 5, but it cannot complete step 6.
The confirmation token expires after 48 hours. This serves the same purpose: a token that lives forever is a token that gets forwarded, archived, and clicked eight months later by somebody who has forgotten what it was.
Expiring tokens mean old links stop working, and the subscriber must visit the subscribe page again to get a fresh one.
Double opt-in is not just about consent. It is the record you will want on the day someone marks your newsletter as spam. It is also a large part of why your messages keep landing in inboxes instead of spam folders.
When a subscriber has explicitly confirmed their address by pressing a button (not just having a link fetched by a machine), you have proof of intent. That proof matters when ISPs evaluate your sending reputation.
Read the full story in the announcement post.