How to clean an email list before your first campaign

A freshly extracted list is not a mailing list. It is a pile of syntactically valid strings, some of which belong to people who might want to hear from you, and some of which are abandoned mailboxes, spam traps, shared inboxes and typos. Sending to it unfiltered is the single most common way a new sending domain gets throttled in its first week.

Cleaning is not one action, it is a sequence — and the sequence matters, because each step changes what the next one sees. This guide sets out the order that wastes the least money on verification credits and leaves the fewest live contacts on the floor.

Why the order of operations matters

Verification is the expensive step. Every provider charges per address checked, and most charge whether the answer is “valid” or “this mailbox was deleted in 2019”. So every filtering step that can run for free belongs before verification, not after.

A worked example. Suppose you extract 12,000 matches from a directory scrape. Deduplication collapses it to 7,400 unique addresses. Removing role accounts takes it to 6,900. Dropping consumer mailboxes, because you sell to companies, leaves 4,100. Subtracting your existing suppression list leaves 3,950. Verify at that point and you pay for 3,950 checks instead of 12,000 — for exactly the same outcome, and roughly a third of the invoice.

Run the same steps in the wrong order and you also lose information. Verifying before deduplicating means paying repeatedly for the same mailbox; filtering domains after verification means throwing away results you have already bought.

Step 1: normalise before you deduplicate

Deduplication is a string comparison, so anything that makes two identical mailboxes look like different strings has to go first.

• Case. The domain half of an address is definitively case-insensitive. The local part technically is not, but in practice every mailbox provider you will encounter treats it as such. Lowercase the whole thing: Dana@Acme.io and dana@acme.io are one person.
• Whitespace and invisible characters. Copy-paste from PDFs and web pages drags in non-breaking spaces and zero-width joiners that look like nothing and compare like something.
• Wrapper punctuation. Trailing commas, semicolons, angle brackets and closing parentheses that came from the source formatting rather than the address.

A good extractor does all three as it parses, which is why the list you copy out of one is usually already normalised. If you are working in a spreadsheet instead, do it explicitly — this is the step people skip and then wonder why their “deduplicated” list still has four copies of the same person.

Step 2: deduplicate, including near-duplicates

Exact deduplication is straightforward once the list is normalised. What catches people out is the near-duplicate: two different strings that deliver to the same human.

Plus addressing. dana+newsletter@acme.io and dana@acme.io arrive in the same inbox at Gmail, Outlook, Fastmail and most others. Someone who signed up to three of your things with three tags is one person who will receive three copies of your campaign. Whether to collapse these is a judgement call — the tag sometimes records genuinely useful signup context — but you should at least know how many you have.

Dots at Gmail. Gmail ignores dots in the local part entirely, so dana.wright@gmail.com and danawright@gmail.com are the same mailbox. This is a Gmail-specific rule; applying it to other domains will merge two genuinely different people, so only apply it when the domain is gmail.com or googlemail.com.

Domain aliases. Companies that have rebranded or been acquired often accept mail at both domains. There is no automatic way to detect this, but sorting your export by domain makes it visible: two domains with a suspiciously similar set of local parts is the tell.

Step 3: remove role and system accounts

Role accounts are addresses that belong to a function rather than a person: info@, support@, sales@, admin@, webmaster@, noreply@, postmaster@, abuse@. There are three separate reasons to strip them.

1. They complain more. A shared inbox is monitored by several people, any of whom can hit the spam button. Complaint rate is calculated per delivered message, and role accounts are heavily over-represented in it.
2. Some are monitored by anti-abuse systems. abuse@ and postmaster@ are required by RFC 2142 to exist and are read by exactly the people who report senders. Mailing them cold is an unforced error.
3. They do not convert. Nobody staffing info@ has authority to buy anything. The reply rate on role accounts is close enough to zero that they cost more in reputation than they return.

The exception worth naming: if you sell to very small businesses, info@ may genuinely be the owner’s inbox. Sole traders and family firms often have nothing else. Know which market you are in before you delete the column.

Step 4: decide about consumer domains

If you sell business-to-business, addresses at Gmail, Yahoo, Outlook, Hotmail, iCloud, AOL, GMX, Proton and the forty-odd other consumer providers are usually not your buyer at their desk. Filtering to company domains only is one toggle and typically removes a third to a half of a scraped list.

Three caveats before you make it a habit. Freelancers, consultants and contractors in many markets use a personal address as their business address. In several countries small businesses run almost entirely on Gmail. And in a recruiting context the personal address is the correct one — a candidate does not want your outreach landing at their current employer.

So treat consumer-domain filtering as a decision about the campaign, not a permanent cleaning rule. Export both versions if you are unsure; the filtered list costs nothing extra to produce.

Step 5: subtract your suppression list

Your suppression list is everyone who has unsubscribed, marked you as spam, hard-bounced previously, or asked to be deleted. Mailing any of them again is at best a repeat bounce and at worst a regulatory problem: under GDPR an erasure request means the address should not be reintroduced from a new source, and under CAN-SPAM an opt-out must be honoured within ten business days and indefinitely thereafter.

This step is easy to forget precisely because the new list feels new. It is not — the same people appear in directory after directory. Export your suppression list from your sending platform, and remove those addresses from the extract before it goes anywhere near a sequence. Keeping a suppression file that outlives any individual tool is the single highest-leverage habit in list hygiene.

Step 6: verify what survived

Only now is verification worth paying for. A verification service performs checks that a pattern matcher structurally cannot: does the domain exist, does it publish an MX record, does the mail server accept that specific recipient, is the domain a known disposable provider, does the address match a spam-trap pattern.

Results come back in roughly four buckets:

• Valid — the server confirmed the mailbox. Send.
• Invalid — no such mailbox. Delete; do not “try it and see”, because that is precisely the bounce you are trying to avoid.
• Catch-all / accept-all — the domain accepts every recipient, so nothing can be confirmed. Common in enterprises. Send in a small separate batch and watch the bounce rate rather than mixing them into your main send.
• Disposable or role — temporary mailbox providers and anything your earlier filter missed. Drop.

Verification results decay. An address checked eight months ago is not a checked address — people change jobs at roughly 20 percent a year, and the mailbox usually goes with them. Re-verify anything older than about three months before a major send.

The numbers that decide whether you get delivered

Mailbox providers do not publish exact thresholds, but the ranges below are consistent enough across published guidance and practitioner experience to plan against.

A raw extracted list, sent unverified, will commonly bounce at 15 to 25 percent — five to ten times the level at which filtering begins. That is why the cleaning sequence is not housekeeping. It is the difference between a campaign that lands and a domain that spends the next quarter in the spam folder.

Sending a cleaned list without burning the domain

Even a perfectly clean list can trigger filtering if it arrives too fast. Reputation is built on volume patterns as well as content.

• Ramp gradually. A domain with no sending history should start in the tens of messages per day and roughly double weekly, not open at 5,000.
• Authenticate first. SPF, DKIM and a DMARC policy are table stakes; Gmail and Yahoo both require them for bulk senders as of 2024.
• Send a seed batch. Take 200 addresses at random, send, and read the bounce and complaint numbers before releasing the rest. A bad list announces itself within an hour.
• Make unsubscribing trivial. A one-click unsubscribe header costs you a contact; a spam complaint costs you deliverability to everyone at that provider.

If you are working with addresses that were collected rather than volunteered, the legal picture also changes — that is covered in using extracted email addresses lawfully.