Email list
Building an email list: signup, proof, deliverability
Some sections describe the law in Germany (as of September 2026). General information, not legal advice. Other countries regulate this differently.
An email list is not a stock you accumulate, it is a balance with an inflow and an outflow, and only confirmed addresses count. A signup becomes a recipient at the moment the person clicks the confirmation link, and what you keep from that moment is the proof: the time of signup, the time of the click, the IP address, the form it came from and the exact wording that stood above it. Everything after that is delivery: three records in your domain settings, SPF, DKIM and DMARC, an unsubscribe that works in one click, and a complaint rate below 0.3 percent. A hundred confirmed recipients who remember signing up are worth more than five thousand addresses you may not write to and could not deliver to anyway.
A list is a balance, not a stock
Almost everyone treats an email list as something that accumulates. You add a form, addresses come in, the number goes up, and one day the number is large. That picture is wrong in a way that costs real money, because it leaves out the other direction: every month people unsubscribe, mailboxes are abandoned, providers stop accepting mail from you, and addresses quietly stop existing.
That makes a list a balance with an inflow and an outflow, and a balance with a proportional outflow does not grow forever. It runs towards a ceiling and stays there. Where that ceiling sits is a matter of arithmetic, and you can work it out further down with your own numbers. Everything else in this article follows from it: quality of intake beats quantity, and a percentage point off the outflow is often worth more than doubling the intake.
Five steps from a typed address to a recipient
This sequence is called the confirmed signup, or double opt-in in the trade. It exists for one reason: anyone can type anyone else's address into a form, so the form on its own proves nothing. The mistakes happen between the steps, which is why each one carries the mistake most often made there.
The confirmed signup, step by step
The form
One field for the address, one sentence above it saying what arrives and how often, one empty checkbox for consent. The box may not be pre-ticked, and the signup may not be bundled with something else. That sentence is also the promise you will be measured against later.
Most common mistake: "We will occasionally keep you informed." That says neither what arrives nor how often, so it is not specific consent.
The confirmation email
The moment the form is submitted, one email goes to the address entered, containing exactly two things: the question whether the signup was intended, and the link. No welcome offer, no first article, no voucher. Anything beyond that turns the message itself into advertising, which at this point it is not yet allowed to be.
A German appeal court held in 2012 that even the confirmation request can count as advertising. The ruling stayed controversial, but the practical consequence is not: put nothing in that message that sells.
The click
Only the click on that link turns a typed address into a recipient. Before it, you have a claim that anyone could have made about anyone else's address. No click, no mail, and the address gets deleted after a set period rather than kept.
Most common mistake: keeping unconfirmed addresses "just in case". They raise the number in your tool and the risk in a dispute, and nothing else.
The record
With the click you record: when they signed up, when they confirmed, the IP address, which form it came from, and the exact wording that stood above that form at the time. The last item is almost always forgotten and matters most, because form text changes and what counts in a dispute is the wording from back then.
The burden of proof sits with you, not with the recipient. They do not have to prove they never signed up.
The first mail
The welcome mail goes out immediately, not with the next send. It delivers exactly what the form promised, repeats the rhythm, and carries the unsubscribe link as visibly as every later message. Wait four weeks and you are writing to people who no longer remember you, and complaints come from not remembering rather than from malice.
From here on, whatever the form said is what you deliver. A list announced as monthly that then sells weekly loses its recipients exactly once.
Everything before the click is a claim. Everything after it is a relationship you can prove.
General orientation, not legal advice. The German references behind these steps are § 7 Abs. 2 Nr. 2 UWG for the consent requirement and Art. 7 Abs. 1 GDPR for the burden of proof; the confirmed signup was accepted as a suitable route by the Federal Court of Justice on 10 February 2011 (I ZR 164/09).
The one exception, and why it is narrower than it looks
There is a route to a customer's inbox without a signup, known as the soft opt-in. It exists in Germany and in the UK in similar form, and it is the single most misread rule in this area, because founders remember the headline and forget that the conditions apply together rather than one at a time.
Four conditions, all at the same time
You received the address in the course of selling goods or a service. You are advertising your own similar goods or services with it. The person has not objected. And you pointed out the right to object clearly, both when you collected the address and in every single message you send with it.
Drop one and the exception is gone. "Similar" is read strictly by the courts: it has to meet the same need, not merely come from the same company. An enquiry that never became a sale is not covered, and neither is a free download, because nothing was sold.
Germany: § 7 Abs. 3 UWG. UK: PECR regulation 22, with a further exception for charitable purposes added by the Data (Use and Access) Act 2025, in force since 5 February 2026 and not retrospective for addresses collected earlier. US: the CAN-SPAM Act requires no prior consent at all, but does require truthful headers, a valid postal address and an opt-out honoured within ten business days, with a maximum penalty of 53,088 dollars per message since the adjustment of 17 January 2025.
Where your list stops growing
Three numbers decide it: how many people sign up each month, how many of them click the confirmation link, and what share of the list you lose each month to unsubscribes, dead addresses and blocks. Put your own in and the ceiling appears. It is not an estimate, it is the point at which the monthly loss cancels out the monthly intake.
What the list settles at
Set your three numbers. The starting values are examples, not benchmarks. Nothing is stored or transmitted.
New signups per month
40
Of those, click the confirmation link
60%
Monthly loss: unsubscribes, dead addresses, blocks
3%
Confirmed recipients over twelve months
245
Month 3
70
Month 6
134
Month 9
192
Month 12
245
At these numbers the list stops growing at about 800 confirmed recipients. Above that, the monthly loss cancels out the monthly intake, however long you keep going.
In the same twelve months, 192 addresses sign up without ever clicking the link. They sit in your tool and you may not write to them. They are not a list, they are a liability.
Your next step
Work on the loss rate first. Bringing it down by one point takes the ceiling from 800 to 1200, which ten extra signups a month would not do. Loss rate is a content question: relevance, frequency and the promise made at the signup form.
The model is deliberately plain: each month the list loses the share you set and gains the confirmed signups you set. The ceiling is the point where the two cancel out, which is confirmed signups divided by the loss rate. No industry averages are used anywhere in this tool, because the ones in circulation cannot be traced to a source that measured them.
Three records decide whether the mail arrives
A list you are allowed to write to is worth nothing if the messages are refused. Since February 2024, Google and Yahoo have required senders of 5,000 or more messages a day to authenticate properly, and Microsoft joined them for mail to Outlook addresses on 5 May 2025. Smaller senders are not exempt from the judgement, they are only exempt from the fixed threshold, and they are judged by the same signals.
The three records live in your domain settings, not in your sending tool. Any decent provider generates them for you and tells you exactly what to paste where. Budget an hour, once.
What the receiving provider checks
SPF Who is allowed to send in your name
required
One entry in your domain settings listing the servers allowed to send for you. Without it, the receiving provider sees mail carrying your name from a source it cannot place.
DKIM The signature on every message
required
Your sending tool signs every message with a key whose counterpart is published in your domain. The receiver checks that nothing was altered on the way.
DMARC What should happen when the check fails
required
The third entry tells the receiver what to do with messages that fail the first two checks, and where to send the reports. To start with, the observe-only level is enough, and those reports are the only way to learn who else is sending in your name.
And two numbers alongside them
An unsubscribe that works in one click, straight from the message header, processed within two days. And a complaint rate below 0.3 percent, which is roughly three people in a thousand marking you as unwanted. That is the threshold at which providers act; a list built from confirmed signups sits far below it without any effort at all.
Requirements as published by Google and Yahoo for bulk senders from February 2024 and by Microsoft from 5 May 2025, in each case for domains sending 5,000 or more messages a day to their users. One-click unsubscribe follows RFC 8058 and applies to marketing mail, not to transactional messages such as order confirmations. The bars above mark the three records as required, side by side; they are not measurements.
Where the signup form belongs, and what else the page has to carry: what a founder's website needs →
Five ways to ruin a list
Each of these was done by someone in a hurry to have a bigger number. All five damage the same thing: the reputation of your sending address, which is the one asset here that takes months to rebuild.
Buying or renting a list
Purchased addresses carry no consent for you, at best for the seller, and consent is not transferable. The damage is twofold: the legal claim, and a complaint rate that permanently damages the reputation of your sending address, including for the people who did want to hear from you.
Importing your address book
Business contacts, people met at a trade show and old enquiries are not signups. Loading your mailbox into a sending tool means writing to people who never filled in a form, and the only open question is how many of them know a lawyer.
Bundling the signup with the order
A pre-ticked box in a checkout, or an entry form that makes the list a condition of taking part, does not produce valid consent. Agreement has to be freely given, and it is only free when saying no costs nothing.
Sending without your own domain
Send to hundreds of recipients from a free mailbox and you cannot set the three records below at all, because the domain is not yours. Sending through a tool on your own domain costs little and is the precondition for everything else.
Carrying inactive addresses along
Addresses that have opened nothing and clicked nothing for a year improve no number at all. They raise your costs, lower every measurable rate, and over time include abandoned mailboxes that get reactivated as traps for unwanted advertising.
Five mistakes that cost the most
The first one decides whether the list was ever going to work. The last one is the reason a list that once arrived quietly stops arriving.
Building the list before there is anything to write. A signup form with no plan for the next six messages collects addresses that will have forgotten who you are by the time the first mail finally arrives.
Filling the confirmation email with marketing. It is the one step at which consent does not yet exist, and therefore the one place advertising has no business being.
Not recording the wording of the form. The text gets changed twice a year, and in a dispute what counts is the version that stood there when the person signed up.
Making the unsubscribe hard. A link that first demands a login or asks for a reason breaks the rule that withdrawing has to be as easy as giving, and produces a spam complaint instead of an unsubscribe. For your deliverability a complaint weighs many times what an unsubscribe does.
Postponing the three records in your domain settings. They cost an hour once and take part in the decision, on every single message, between the inbox and the promotions folder.
Frequently asked questions
Is a form signup enough on its own?
Not until the confirmation link has been clicked. Anyone can type someone else's address into a form, which is why the entry alone proves nothing. The click, recorded with its timestamp and IP address, is the proof that holds up in a dispute. In Germany the Federal Court of Justice confirmed this procedure as a suitable route for email advertising in 2011, and in the UK the regulator expects the same standard of evidence.
May I email my customers without consent?
In the UK and Germany there is a narrow exception, often called the soft opt-in, and it only applies when several conditions hold at once: you obtained the address in the course of a sale, you are promoting your own similar goods or services, the person did not object, and you pointed out the right to object both when you collected the address and in every message since. In the US the CAN-SPAM Act needs no prior consent at all, but requires truthful headers, a valid postal address and a working opt-out honoured within ten business days.
What do I have to keep as proof of consent?
When they signed up, when they confirmed, the IP address, which form the signup came from, and the wording that stood above that form at the time. The burden of proof sits with the sender. A tool that cannot export those items is the wrong tool for a list with any legal exposure attached to it.
Why do my emails land in the promotions or spam folder?
Usually one of three records in your domain settings is missing: SPF, DKIM and DMARC. Google and Yahoo have required all three since February 2024 from senders of 5,000 or more messages a day, and Microsoft since 5 May 2025 for mail to Outlook addresses. On top of that come one-click unsubscribe and a complaint rate below 0.3 percent. Smaller senders are judged by the same criteria without a fixed threshold, so setting the three records covers most of it.
How fast do I have to action an unsubscribe?
As fast as technically possible, which in practice means immediately. Google requires larger senders to process an unsubscribe within two days. US law sets an outer limit of ten business days. Under UK and EU data protection law, withdrawing consent has to be as easy as giving it, and any delay produces the most expensive outcome available: a spam complaint instead of an unsubscribe.
Read next
Is the idea behind the list worth the list?
A list only pays off when there is something worth writing about. 4 to 12 AI experts assess market, financials and risks of your specific idea, in minutes, from € 5.99.
Assess my idea →