Most deliverability problems are list problems that show up late. The bounces, the spam-trap hits and the complaints that wreck a sender's reputation all start with who was on the list. Authentication and warmup get your mail a fair hearing. The list decides what the verdict is.
This post covers how to source a list, why to verify it, which addresses to treat with suspicion, how to keep it clean, and the legal basics at a high level.
How a list damages a domain
Three things on a list hurt you.
Addresses that do not exist. Each one produces a hard bounce. To a mailbox provider, a sender who keeps mailing unknown addresses does not know their recipients, which is a fair description of a spammer.
Spam traps. These are addresses run by providers and blocklist operators to catch senders with poor list practices. Some were never owned by a real person and appear only on scraped lists. Others are abandoned addresses that were later repurposed. Traps do not bounce and do not complain. They just record that you mailed them.
People who should not be there. Wrong role, wrong industry, wrong country, left the company two years ago. These recipients generate complaints, and complaints are the signal mailbox providers take most seriously.
Sourcing principles
Start from a written definition of fit. Industry, company size, role, region, and the problem you solve. If you cannot say why a contact is on the list, they should not be on it.
Know where each record came from. A source that can tell you how and when an address was collected is worth more than one that cannot. Freshness matters because people change jobs, and an address that was good last year may be gone now.
Be wary of bulk purchased lists. A list sold to you has been sold to others. Its addresses have been mailed heavily, its accuracy is unknown, and it is where traps tend to be found. If you use third-party data, treat it as raw material that has to pass verification and a fit review, not as a finished list.
Do not scrape addresses off web pages. Harvested addresses are the classic source of traps, and harvesting is specifically called out as an aggravating factor under CAN-SPAM.
Prefer named business addresses. For B2B outreach, write to a person at their work address. Personal addresses raise both the complaint risk and the legal risk.
Smaller is better. A few hundred contacts who fit are worth more than several thousand who might. The smaller list also means fewer emails sent per conversation, so it spends less of your reputation.
When the list is ready, importing leads from a CSV covers the field mapping. If you are starting from nothing, the lead database holds contacts whose emails passed verification, and the free lead sample tool sends 25 of them for an industry, role and country.
Verify before you send
Verification checks whether an address can receive mail, without sending a message to it. A verifier looks at several layers:
- Syntax. Whether the address is well formed and free of stray characters from copy and paste.
- Domain. Whether the domain exists and publishes MX records, meaning it accepts mail at all.
- Disposable domains. Throwaway address services that will never be a buyer.
- Mailbox. Whether the receiving server says this specific mailbox exists.
Results come back as valid, invalid, catch-all or unknown. Remove the invalid ones. Hold the unknown ones and check them again later.
Timing matters as much as the check itself. Verify close to the send, not when you built the list. A list verified in spring and mailed in autumn has decayed in between.
Fuzegenai verifies lead addresses when a campaign launches and checks each recipient again before the send. Addresses that prove invalid are dropped and added to your suppression list, and role accounts are skipped unless you choose to allow them. Email verification has the detail.
Role accounts and catch-alls
Role accounts are addresses such as info@, sales@, support@ and admin@. They belong to a function, not a person. Several people may read them, none of them asked to hear from you, and any one of them can report you. Your email is also unlikely to reach a decision-maker that way. Skip them by default. If a small company lists only a role address, it is a better use of time to find the owner's name.
Catch-all domains accept mail for any address, real or not, so a verifier cannot confirm the mailbox. The message may reach a person, bounce later, or be silently discarded. Treat catch-alls as risky, not as invalid:
- Keep them as a small share of any one send.
- Send to them from your healthiest mailboxes, not from ones still building reputation.
- Watch the bounce results, and drop the domains that bounce.
- Leave them out entirely while a domain is new or recovering.
List hygiene and suppression
A suppression list is the set of addresses you will never email, whatever list they turn up on later. Keep one, and make it apply across every campaign. It should hold:
- Everyone who unsubscribed or asked you to stop, in any wording, through any channel.
- Every hard bounce.
- Anyone who complained.
- Current customers, open opportunities, partners and competitors, unless a campaign is meant for them.
- Whole domains where a company has asked you not to contact it.
Beyond suppression:
- De-duplicate across campaigns. One person receiving two of your sequences in the same week will not read either kindly.
- Normalise the data. Trim whitespace, fix obvious domain typos, clean up names and titles. A broken merge field in the first line reads as automation.
- Retire finished contacts. Someone who received a full sequence and never replied should rest for months, not slide into the next campaign.
- Re-verify old lists before using them again.
Consent and the law, in brief
This section is general information, not legal advice. Rules differ by country and change over time, so get advice for the markets you sell into.
United States: CAN-SPAM. Unsolicited commercial email is permitted, with conditions, set out in the FTC's compliance guide for business. Header information and subject lines must not be deceptive. The message must include a valid physical postal address. It must offer a clear way to opt out, and opt-outs must be honoured within ten business days. In practice, honour them at once. Mailbox providers expect far faster handling than the law does, as Google and Yahoo's bulk-sender rules show.
European Union and United Kingdom: GDPR. A business email address that identifies a person is personal data. B2B outreach commonly relies on legitimate interest as its lawful basis (Article 6(1)(f) of the regulation), and that needs care. You are expected to have weighed your interest against the recipient's, to contact people only about matters relevant to their professional role, to say who you are and where you obtained their details, and to make objecting easy. Separate national e-privacy rules sit alongside GDPR, and some countries require prior consent for email marketing even between businesses.
Elsewhere. Some countries, Canada among them, take a consent-based approach that is stricter than the United States. Check before you add a new region to a campaign.
What keeps you legal and what keeps you deliverable point the same way: relevant messages, honest identification, an easy way out, and a firm rule against emailing anyone who said no.
The takeaway
Build the list as if each address costs you a little reputation, because it does. Define fit before sourcing. Know where records came from. Verify close to the send. Skip role accounts, ration catch-alls, and keep one suppression list that every campaign obeys. A careful list of a few hundred people is safer than a careless list of thousands, and it is the one part of deliverability that is entirely in your hands.