Email verification

Format validation checks the string is shaped like an address. It runs client-side, costs nothing, and proves almost nothing — asdf@asdf.com passes every regex ever written. It is not a defense; it is a typo check, and it belongs on every form for that reason alone.

Deliverability checking goes further: resolve the domain’s MX records, then probe the mail server to ask whether the mailbox exists. Commercial services wrap this with disposable-domain lists, role-account detection (info@, sales@) and a confidence score. It runs server-side, costs a fraction of a cent per check, and answers a real question.

Double opt-in sends a confirmation link and only accepts the submission once it is clicked. It is the only one of the three that establishes a person had access to the mailbox at a specific moment.

Deliverability checking removes fabricated addresses at non-existent domains and mailboxes that do not exist at real ones. It also catches the pattern that made one B2B team give up on their page entirely:

But the highest-value thing it does has nothing to do with spam, and it is the reason to buy it even if you have no spam problem at all. It catches gmial.com, hotmial.co.uk, and the address with a fat-fingered surname — real buyers whose lead is currently landing nowhere and being counted as a conversion. That is recovered revenue, and it is a larger number than the spam saving at most companies.

Double opt-in stops essentially every fabricated address, because a fabricated address cannot click.

A working mailbox is free and takes forty seconds to create. Anyone spending money to fill your form has a deliverable address, so deliverability checking is a filter on carelessness, not on intent.

Two technical limits erode it further. Catch-all domains accept mail for every local part, so the probe returns “valid” for notarealperson@theircompany.com — and catch-alls are common at exactly the mid-market companies you sell to. And the large providers increasingly refuse or throttle verification probes, which returns “unknown,” which your integration then has to treat as pass or fail, and either choice is wrong some of the time.

Double opt-in is not defeated so much as paid for. The confirmation email is a second conversion step, on infrastructure you do not control, and it lands in spam often enough that people plan around it:

You have not removed the drop-off. You have moved it somewhere you cannot instrument — it will not appear in your drop-off analysis, because the abandonment happens in a mail client.

Run format validation always, and deliverability checking on any form where a lead is worth more than a cent — which is every lead-gen form. Buy it for the typo recovery and treat the spam reduction as a bonus.

Use double opt-in when the integrity of the list matters more than the count: newsletters, anything with a sending reputation attached, anything where a wrong address costs you deliverability. Do not use it on a demo request, where a lost confirmation click is a lost deal.

And when a check comes back uncertain, flag rather than reject. A submission held for review costs you a minute. A rejected buyer costs you the account, and you never find out it happened.