Create a pending record, not an active subscriber

When a person submits an address, store a pending request with the list/purpose, notice version, source, UTC time, and a short retention deadline. Do not add it to campaign audiences before confirmation. Rate-limit repeated submissions and avoid revealing whether the address is already subscribed.

Generate a random, single-use, expiring token and store only a secure digest where possible. Bind it to the exact pending request. Do not put the address, list name, or internal user ID in a predictable URL.

Write for an unexpected recipient

The message should answer:

  • who is asking;
  • which list or message type is involved;
  • what the recipient can expect and approximate frequency;
  • which button confirms;
  • what happens if they did not request it;
  • how to contact the sender safely.

Avoid promotional offers that turn confirmation into marketing before permission exists. Use a truthful From name and Reply-To monitored by the responsible team. Make the confirmation link visually clear and provide a plain-text equivalent.

Make inaction safe

If the recipient does nothing, leave the request pending and delete it after the documented period. Do not repeatedly send reminders without a reviewed, limited policy. A malicious signup should not force the address into an unsubscribe workflow for a subscription it never confirmed.

The link should open a page that describes the pending request and requires a deliberate POST/confirmation action where link scanners might otherwise consume it. Use CSRF protection and rotate or invalidate the token after success. Return a useful but non-enumerating response for expired or already-used links.

Record the evidence

On confirmation, store the purpose/list, notice version, request source, request time, confirmation time, and technical evidence necessary for audit. Minimize IP/user-agent retention and set deletion rules. Confirmation proves control of the address at that moment; it does not grant permission for unrelated brands or purposes.

Test the complete path

Cover duplicate requests, existing subscriber, typo, token expiry, scanner GET, CSRF, replay, unsubscribe-before-confirm, and provider outage. Confirm that a pending address never enters a campaign export. The message is successful when a person can understand and confirm one specific request—and an uninvolved recipient can safely ignore it.