How to Deliver a Free Download (Lead Magnet) Properly: Consent, Double Opt-In, a Link Not an Attachment, Deliverability and Unsubscribes

You offer a free checklist, template or short guide on your website, and visitors get it by typing in their email address. Or a client wants one on their site and has asked you to “just set it up”. It looks like a five-minute job: a form, an email with a PDF attached, done. Then the emails start landing in spam, someone complains they never asked to be on a list, your bounce rate climbs because bots are filling in the form, and nobody can say whether the thing is working.

This guide is for designers, freelancers and site owners who deliver a free download (often called a lead magnet) in exchange for an email address. It covers the whole path: what the form should say, how to confirm the address, how to deliver the file so it arrives, how people leave, how to keep the list healthy and what to measure. It is vendor neutral: every email platform and form plugin worth using can do all of this, so look for the setting names given here in your own tools.

Not legal advice. This guide explains common rules in plain terms. Email and privacy law depends on where you are and where your subscribers are, and it changes. If you rely on a specific rule, check it against the official source or with a lawyer who works in your jurisdiction.

What “properly” means

A free download is delivered properly when five things are true:

1. Honest consent. The visitor knows exactly what they are getting, what else you will send and how to stop it.
2. A confirmed address. The person who typed the address controls the inbox (double opt-in).
3. A delivery that arrives. A link to the file, sent from your own domain through a service with SPF, DKIM and DMARC in place.
4. An easy exit. One click to unsubscribe, honored quickly, and never undone by a later import.
5. A clean list you can measure. Bounces, complaints and unconfirmed signups removed, and a few honest numbers watched every month.

Step 1: Say exactly what they are signing up for

Most complaints start at the form. Someone wanted one PDF, then got three emails a week they never agreed to. Fix that with plain words next to the button:

• What they get: “Enter your email and we will send you a link to the website launch checklist (PDF, 2 pages).”
• What else you will send, if anything, and how often: “We also send a short tips email about once a month. Check the box if you want it.”
• Who you are, and a link to your privacy policy, which names the email service that stores the list.
• How to stop: “Every email has a one-click unsubscribe link.”

Consent and lawful basis

Sending someone the file they asked for is doing what they requested. Sending them a newsletter afterward is marketing, and in many places that needs its own consent.

Where your subscribers are	The rule in short	What it means for a free download
EU and UK (GDPR, plus the ePrivacy rules: PECR in the UK)	Email marketing to individuals generally needs consent. Consent must be freely given, specific, informed and a clear action. GDPR Recital 32 says silence, pre-checked boxes and inactivity are not consent.	Use an unchecked newsletter box, separate from the download. Keep a record of what the person agreed to. The UK “soft opt-in” exception is tied to a sale or negotiations for a sale, and whether a free download counts is doubtful, so do not rely on it without advice.
United States (CAN-SPAM)	No opt-in requirement, but every commercial email must have accurate sender details, an honest subject line, a valid physical postal address and a working opt-out honored within 10 business days.	Include your postal address and an unsubscribe link in marketing emails. Opt-in is still the better habit, because inbox providers judge you on complaints, not on what the law allows.
Canada (CASL)	Commercial electronic messages generally need consent first, and must identify the sender and include an unsubscribe mechanism.	Treat it like the EU: ask first, record it, make leaving easy, and check which consent type and record keeping rules apply to you.

Read the primary sources when it matters: the GDPR text on EUR-Lex (Articles 4, 6 and 7 and Recital 32) and the FTC CAN-SPAM compliance guide.

Should the download require joining the newsletter?

Many sites make the newsletter the price of the download. Under GDPR, Article 7(4) asks whether something is being made conditional on consent that it does not need, and regulators and courts do not all agree on how that applies to free resources, so check the position where you and your subscribers are. The lowest-risk pattern is simple: send the download to everyone who confirms, and offer the newsletter as a separate, unchecked box. You get fewer subscribers, but they actually want your emails, which is what keeps complaint rates low.

Keep proof of consent

GDPR Article 7(1) expects you to be able to show that someone consented. Store, for each subscriber: the date and time of signup and of confirmation, the form or page they used, the exact wording they saw (or a version number for it), and what they checked. Most email platforms store signup and confirmation times automatically. Write down the form wording yourself each time you change it.

Step 2: Confirm the address with double opt-in

Double opt-in (some platforms call it confirmed opt-in) means the signup is not active until the person clicks a link in a confirmation email. The flow looks like this:

1. The visitor submits the form. You store the address as unconfirmed.
2. You send one short confirmation email with a unique link.
3. They click it. You mark the address confirmed, record the time and show the download.
4. Unconfirmed addresses are deleted automatically after a set time, for example a week.

Why bother when it loses some signups:

• It proves the person controls the inbox, which is your best evidence of consent.
• Typos (gmial.com) and made-up addresses never reach your list, so bounces stay low.
• Bots and pranksters cannot sign up someone else’s address. Mass signups of a victim’s address, sometimes called subscription bombing, get one confirmation email each and nothing more.
• A list of people who clicked is a list of people who open, click and rarely complain, and inbox providers reward that.

Build the confirmation step well

• Long, random, single-use links. The token in the link should be impossible to guess and should stop working once used or expired.
• Limit resends. Rate limit confirmation emails per address and per visitor, so a bot cannot use your form to flood an inbox.
• Keep the email plain. Name your site, say what they asked for, give the button, and add: “If you did not ask for this, ignore this email and you will not hear from us.” No marketing in the confirmation email.
• Use a button page, not an instant confirm. Some company mail security systems open links in incoming email to check them for malware. If merely loading the link confirms the signup, those scanners confirm addresses nobody clicked. Make the link open a page with a “Confirm my email” button that submits a form, and confirm only when that button is pressed.
• Deliver straight away. After confirmation, show the download link on the page itself, and send it by email as a backup.

Stop bots before they reach the confirmation step too: a hidden honeypot field, a rate limit per IP address and a time check on how fast the form was filled in. The form spam guide explains each one.

Step 3: Send a link, not an attachment

Attaching the PDF feels friendlier. It works against you:

• Attachments make messages larger and draw closer inspection from spam filters, and some company mail systems hold or strip attachments from unknown senders.
• Many email platforms limit or do not offer attachments in automated emails, which pushes people toward sending from their own mailbox, where none of the protections in this guide exist.
• Once a file is attached, you cannot fix it. With a link, a typo fixed today is fixed for everyone who downloads tomorrow.
• A link opens comfortably on a phone, and the same link can sit on the thank-you page.

Host the file on your own domain over HTTPS, for example https://example.com/downloads/launch-checklist.pdf or in the WordPress media library. Give it a clear file name, keep the address stable when you update the file (people find old emails months later) and avoid public link shorteners, which spammers use heavily and filters distrust.

A “secret” link is not private. Once emailed, it can be forwarded or posted. That is fine for a free resource. If the file must stay restricted, put it behind a login rather than relying on an unguessable address.

Step 4: Make sure the emails actually arrive

Send from your own domain, through a proper service

Send from an address on your own domain, such as hello@example.com. Do not send list mail “from” a free mailbox address such as a Gmail or Yahoo address through another service: the big free mailbox providers publish strict DMARC policies, so mail claiming to come from their domains but sent from elsewhere is likely to be rejected or junked.

Send through an email marketing platform or a transactional email service, not the web server’s built-in PHP mail. If WordPress sends the confirmation, connect it to the service with an SMTP or API plugin; the WordPress not sending email guide walks through that. Some senders put list mail on a subdomain such as news.example.com, so its reputation stays separate from everyday staff email. Your platform’s setup screen will say whether it supports that.

SPF, DKIM and DMARC

• SPF lists the servers allowed to send for your domain. Add the service’s include to your existing SPF record. A domain must have only one SPF record, and SPF allows at most 10 DNS lookups, so do not paste a second record.
• DKIM signs each message with your domain. The service gives you one or more DNS records (usually CNAME or TXT) to publish. Until they are in place, mail is often signed with the service’s domain instead of yours.
• DMARC tells receivers what to do when a message fails, and requires that the SPF or DKIM domain matches the From domain (alignment). Start with p=none and a reporting address, read the reports, then tighten.

The details, with exact records, are in emails going to spam: fix SPF, DKIM and DMARC and website and email at different providers. To check what is published, run these in a terminal on your own computer (Terminal on macOS, any Linux shell; on Windows use nslookup -type=TXT with the same names):

dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig +short CNAME s1._domainkey.example.com

Replace example.com with your domain and s1 with the DKIM selector your service gave you. +short prints only the answer. Good output: exactly one line starting v=spf1 that includes your service, one line starting v=DMARC1, and a DKIM answer that points at your service. Bad output: two v=spf1 lines, no DMARC answer, or an empty DKIM answer. The email diagnostic tool runs the same checks in a browser.

Test like a subscriber

Sign up with a personal Gmail address and an Outlook.com address. In Gmail, open the confirmation email, open the three-dot menu and choose “Show original”: the SPF, DKIM and DMARC lines should all say PASS, and the DKIM domain should be yours. If the email landed in spam, fix authentication before anything else. Gmail, Yahoo and Microsoft also have extra rules for senders who reach high daily volumes; they are listed in Gmail, Yahoo or Outlook rejecting your email, and they are good habits at any size.

Step 5: Make leaving easy

• Every marketing email needs a visible unsubscribe link that works in one click, without a login.
• Add one-click unsubscribe headers (List-Unsubscribe and List-Unsubscribe-Post, defined in RFC 8058). Most platforms add them for you. Check “Show original” for them.
• Honor opt-outs fast. Google and Yahoo ask bulk senders to do it within two days, and CAN-SPAM allows at most 10 business days. Platforms usually do it instantly.
• Keep unsubscribed addresses on a suppression list. Deleting them outright means the next import of an old spreadsheet can quietly add them back.
• Put your postal address in marketing emails. CAN-SPAM requires it, and it reassures readers elsewhere too.

Step 6: Keep the list clean

• Unconfirmed signups: delete them automatically after your chosen period. They are not subscribers.
• Hard bounces (the address does not exist): remove after the first one. Soft bounces (mailbox full, server busy): remove after repeated failures across several sends. Most platforms do both; check the setting is on.
• Complaints (marked as spam): suppress immediately and never email that address again.
• Long-silent subscribers: after a period you choose with no clicks, send one “still want these?” email, then remove anyone who does not respond.
• No bought, rented or scraped lists, and no importing a client’s old contact spreadsheet into a new newsletter without finding out how each address was collected.
• Data you hold: collect only what you use (often just the email address), say in your privacy policy which service stores the list, accept the service’s data processing terms where GDPR applies, and know how to answer an access or deletion request (see handling data requests).

Step 7: What to measure

A few numbers, checked monthly, tell you whether delivery works. Work them out from your platform’s reports.

Measure	How to work it out	What a change tells you
Confirmation rate	Confirmed signups divided by all signups	A sudden drop usually means the confirmation email stopped arriving or went to spam. Test it yourself that day.
Bounce rate on confirmation emails	Bounced divided by sent	A rise points to bot signups or typos. Tighten the form protections in Step 2.
Spam complaint rate	From your platform, and from Google Postmaster Tools for Gmail recipients	Any rise means people do not recognize you or did not expect the email. Check the form wording in Step 1.
Unsubscribes per email	Unsubscribes divided by delivered, per send	A spike after one email shows a mismatch between what people signed up for and what you sent.
Downloads	Visits to the file address in your analytics or server log	Compare with confirmations. Far fewer downloads than confirmations suggests the link or page is broken.

Treat open rates as rough at best. Apple Mail Privacy Protection loads tracking images for many Apple Mail users whether or not they read the message, and other mail apps block images. Click tracking also rewrites your links through the platform’s own domain; if your platform offers a custom tracking domain on your own domain, set it up, or switch tracking off for the delivery email so the file link stays a plain link to your site.

If the download email is not arriving

What you see	Likely cause	What to do
Form says thank you, but no email arrives anywhere	The form is not connected to the list, or the site cannot send mail	Check the platform’s activity log, then follow form submits but no email arrives.
Arrives, but in spam or junk	Missing or failing SPF, DKIM or DMARC, or an attachment	Step 4, then send a link instead of a file.
Reaches Gmail but not company addresses	Company filters holding links or attachments from new senders	Use a link on your own domain, and ask the recipient to check their quarantine.
Addresses confirm within seconds, without anyone clicking	Security scanners opening links	Switch to a confirm button page (Step 2).
Bounces mention 5.7.26 or “unauthenticated”	The receiving server rejected mail that failed authentication	Read email bounce codes explained and fix DMARC alignment.
Dozens of signups from odd addresses	Bots or subscription bombing	Double opt-in, honeypot and rate limits (Step 2).

If you set this up for a client

• Open the email platform account in the client’s name, with their card, and add yourself as a user. They are the sender and they own the list.
• Record the platform, sending domain, DNS records and who has login access, in the handoff document.
• Add the platform subscription to the renewals register, so a lapsed card does not silently stop every confirmation email.
• Show the client the measures in Step 7 and who to contact if the confirmation rate drops.

See also

• Gmail, Yahoo or Outlook rejecting your email: the sender requirements
• Emails going to spam after a DNS change: SPF, DKIM and DMARC
• WordPress not sending email
• Server IP or domain on an email blocklist
• What a small business website needs for privacy
• Stop contact form spam on WordPress