Newsletters and Marketing Email

Consent first

• Double opt-in: after someone subscribes, send a confirmation link; only confirmed addresses get newsletters. It stops fake sign-ups and protects your reputation.
• Record when and how each person consented.
• Make it clear what they are signing up for and how often you will email.

Unsubscribing

• Every marketing email needs a working one-click unsubscribe link.
• Support the List-Unsubscribe header (with one-click), which mailbox providers display as an unsubscribe button and increasingly expect from bulk senders.
• Process unsubscribes promptly and never email that address again for marketing.

Laws to know (not legal advice)

Get local legal advice for your situation, especially for client projects in other countries.

Building a newsletter feature

@newsletter_bp.post("/subscribe")
@limiter.limit("5 per hour")
def subscribe():
    email = validate_email(request.form.get("email"))
    sub = Subscriber.get_or_create(email)
    if not sub.confirmed:
        sub.token_hash = hash_token(token := secrets.token_urlsafe(32))
        db.session.commit()
        queue_email(email, "Confirm your subscription", confirm_link(token))
    flash("Check your inbox to confirm.")      # same message whether new or existing
    return redirect(url_for("main.index"))

Many teams send campaigns through a dedicated newsletter service and sync confirmed subscribers via its API, rather than building campaign tools themselves.

Segmentation and frequency

Send people what they asked for: let them choose topics, segment by interest or activity, and keep a predictable schedule. Fewer, more relevant emails beat frequent generic ones.

Exercise

Build double opt-in newsletter sign-up with a rate limit, a confirmation email, a one-click unsubscribe link and List-Unsubscribe header, and an admin export of confirmed subscribers.

Check yourself

• What does double opt-in protect against?
• Why support the List-Unsubscribe header?
• What must every marketing email include?