How do I "verify" an email address?

Our mailing list rules require you to "verify" each address (the Mailman mailing list system we provide does this automatically when you “invite” people to join). This is an important concept.

Imagine you receive a mailing list signup request that seems to be from "charlotte@example.com". Perhaps someone wrote down that address on a piece of paper, for example, or entered it on your website.

It's likely that charlotte@example.com really did sign up, but there are other possibilities, too:

  • Perhaps a totally different person — say, "charlotte123@example.com" — really intended to sign up, but mistyped her correct email address.
  • Perhaps Charlotte's friends are misguidedly subscribing her to a list they think she might like, even if Charlotte has never heard of you and isn't interested in your list.
  • Perhaps Charlotte's enemies are subscribing her to lists just to annoy her.

All of these things happen far more often than you would think, and you would be sending unwanted mail ("spam") to strangers if you sent messages to "charlotte@example.com" without any further checks.

Solving the problem

So what can you do to make sure this doesn't happen? The answer is to verify the address. When you receive a subscription request for charlotte@example.com, send a message to that address, asking the recipient to take an additional step to verify she really wants to be on your list. For example, the person can click a link in the message you send, or reply to the message.

When the person verifies the subscription, you permanently record the verification details and add them to your list.

If the person does not verify the subscription, do not add that address to your list. This guarantees that addresses cannot be subscribed to the list against their will, and protects you from accusations of spamming. (Some people call this system "double opt-in", "confirmed opt-in", or "closed loop confirmation".)

If you use our Mailman list management system, the verification step happens automatically when subscribers use the list signup page or you subscribe someone using Mailman's "verify/invite" option. Mailman also keeps appropriate records for us. As long as people subscribe themselves, or you subscribe them using the "verify/invite" option, you don't need to do anything else.

But if you use your own mailing list software, or if you don't use Mailman's "verify/invite" option when you manually subscribe someone to a list, you must make sure a verification step is performed. This can be as easy as sending a manual message to the address and asking them to reply and say they want to be on your list.

You must also permanently keep a record of exactly how the person verified the subscription (the date, time and IP address of the computer used to click on the link, for example, or a copy of the email reply). All good mailing list programs can do this automatically; just be sure the appropriate feature is enabled. If you verify the address manually, you’d simply keep a permanent copy of the reply.

Do paper forms count as verification?

No, they don't. You still need to separately verify the address. See our page about paper signup forms for details.

Is there a deadline for verifying an address?

We’re occasionally asked if it’s okay to start a new list by verifying addresses that were given to you some time ago.

Our general rule is that the person at each address should have interacted with you in some way within the last year. Anything more than that results in many people marking the messages as “spam”, and we don’t allow the sending of messages that are likely to be marked that way.

Is verification an unusual requirement?

Not at all. Almost every ISP, hosting company, and mailing list provider has policies or guidelines that require verifying addresses.

The Spamhaus anti-spam organization lists large ISPs, including GMail, Yahoo and Microsoft, that require you to use "confirmed opt-in" if you send bulk mail to their members.

Even large mailing list companies that previously avoided address verification, such as Constant Contact, now say that address verification ("confirmed opt-in") is the right way to run a mailing list.

What would happen if I didn't verify addresses? Does it really matter if a handful of incorrect addresses are added?

You might think that such people would just unsubscribe, but that isn't the case — they'll complain instead. This will give your list a “bad reputation” with some ISPs, and they’ll then deliver your list mail to spam folders, which you definitely don’t want.

And if we allowed many of our customers to run unverified mailing lists, our servers themselves will get a bad reputation and end up on "blacklists". This would mean that our customers would be unable to send normal mail to many locations, which would be disastrous for our customers and our company.

We'd have no choice but to immediately terminate your account if your unverified mailing list caused any of our servers to be blacklisted. Don't risk it — make sure your mailing list software verifies all subscription requests (or do it manually), then keep excellent records.