How to Verify a Cold Email List Before You Send

Verify a list before the first send so that bounces do not count against the domain you send from, and so you do not spend sends on contacts you never reach. Treat that as the working reason for every step below.

This guide is a workflow, not a tool review. It runs from raw list to approved send, with a decision for each type of risky address. The goal is a clean B2B email list you can defend: every address has a source, has been checked, and sits in a segment with a rule about what happens if it bounces.

Who this is for

This guide is for anyone about to send cold email from their own domains or mailboxes. That includes founders sending their first campaign, sales ops people inheriting a purchased or exported list, and agencies loading client lists into a sequencer.

It assumes you already have a list. It does not cover how to decide who belongs in your ideal customer profile. For that, the free ICP assessment is a separate step. It also does not tell you which markets to sell into. That is your decision, and Outlevo asks which countries you sell into rather than proposing markets [[1]](#sources).

If you only send a few dozen hand-written emails a week, you can skim the steps. If you load hundreds of addresses at a time, do all of them.

Steps

1. Record where each address came from

Before you check anything, add two columns to the list: source and date. An address with no source is the first thing to drop when you cut risk.

This is also how Outlevo treats account data. A Readiness Card carries a data quality score and needs at least three observations, each with a source and a date [[2]](#sources). Facts read from a website are kept only when their quote is found on the page, and guesses are labeled as hypotheses [[2]](#sources). You can copy the habit in a spreadsheet: separate what you saw from what you assumed.

Then remove exact duplicates, and remove duplicates that differ only by capital letters. Sending the same person two openers on the same day looks careless and doubles any bounce.

2. Run syntax and domain checks

These are the cheap checks, and they remove the obvious failures before you spend credits on anything deeper.

Syntax. Drop addresses with no @, spaces, double dots, or a missing domain ending. Fix obvious typos in common domains if you can confirm the correct spelling. If you cannot, drop the row.
Domain. Drop addresses whose domain does not exist or is not set up to receive email. A parked or expired company domain is a bounce waiting to happen.
Placeholders. Drop test addresses, "noreply" addresses and anything a form filler would invent.

Do these checks by hand when the list comes from a source you do not trust. Anything you remove here is a credit you do not spend in the next step.

3. Verify each mailbox

Syntax and domain checks tell you the address is well formed and the domain can receive mail. They do not tell you whether that person's mailbox exists. For that you need a verification service. The email verification glossary entry covers the term in more detail.

You have two kinds of option, and the costs differ.

Inside Outlevo. Email verification costs 1 credit per check [[3]](#sources). Builder is USD 29 per month with 320 credits a month, and Growth is USD 149 per month with 1650 credits a month [[3]](#sources). Check your balance before you load a large list. For comparison, contact discovery costs 4 credits and volume contact discovery costs 2 credits [[3]](#sources).

A standalone tool. ZeroBounce describes itself as helping you "verify emails, clean your list, build your sender reputation, and monitor inbox health" [[4]](#sources). Its pricing, as read on October 26, 2026:

Freemium: $0 a month with 100 validation credits [[5]](#sources).
Pay as You Go: starts at $39 for validating 2,000 email addresses, which is the minimum purchase [[6]](#sources).
ZeroBounce ONE: a subscription at $99 a month [[7]](#sources).
Annual billing: saves 20% on subscriptions [[8]](#sources).

Prices change, so read the ZeroBounce pricing page before you buy. For other tools in this category, see the data and enrichment comparison.

Pick the option by volume and by where the list lives. A small list you will send this week is simplest to check where you send. A large list you will reuse is worth a separate pass.

Whichever you use, sort the results into four groups: valid, invalid, risky (including catch-all), and unknown. Invalid addresses go to the suppression list in the suppression step below, not into the trash. If you delete them, the same address can come back in your next import.

4. Handle catch-all addresses on purpose

A catch-all domain is one where a check cannot tell you whether a specific mailbox exists. The catch-all glossary entry has the definition. These addresses are the hardest call in list cleaning, because a "risky" label is not a verdict. Some will reach a person and some will bounce.

Here is a rule you can apply without knowing the exact share of catch-all addresses in your list:

Separate them. Put catch-all addresses in their own segment. Do not mix them into the verified campaign, where their bounces would hide inside a good number.
Decide who gets them. If a catch-all contact is a perfect fit for your ideal customer, keep it. If the fit is marginal, leave it out. Marginal fit plus delivery risk is the worst trade on the list.
Send last, and send small. Run the verified segment first and watch the bounces. Only then send the catch-all segment, in its own campaign, so you read its bounce rate on its own.
Write down the stop rule first. Decide what bounce rate pauses the catch-all campaign before it starts. The pause-rule step below covers this.

Use a second route where you can. If you have a verified address for another person at the same company, you may not need the catch-all one at all.

5. Deal with role addresses

Role addresses are shared inboxes such as info@, sales@, support@ or admin@. Treat them as weak targets for cold email, for three reasons. Several people may read them, so nobody feels addressed. They may have filters or ticketing tools on top. And the person you want may never see your message.

A workable rule:

Remove role addresses from the automated sequence.
If the company is a strong fit and you have no named contact, route it to manual research. Find a person, verify that address, and add it to the list.
Keep one exception: if the role address is the only published way to reach a very small company, send one hand-written message from a normal mailbox, outside the sequence.

Role addresses can pass a mailbox check, since the inbox exists. A "valid" label does not make them a good target.

6. Suppress past bounces, opt-outs and anyone you should not contact

Verification looks at the address today. Suppression remembers what already happened. You need both.

Build one suppression list and apply it before every upload. It should hold:

Every address that has hard bounced in an earlier campaign.
Every address that unsubscribed or asked not to be contacted.
Invalid addresses from the verification step.
Current customers, partners and anyone your team has marked do-not-contact.

Where the data comes from:

Your sequencer. When you send through Smartlead, Smartlead sends from the mailboxes in your Smartlead account, and Outlevo reads sent, reply, bounce, unsubscribe and category-change events back by webhook [[9]](#sources). Those bounce and unsubscribe events are the raw material for your suppression list.
Your CRM. HubSpot contact import is optional and carries email, name, job title and email opt-out, and only after an admin turns it on with a stated purpose [[10]](#sources). That is the route for bringing CRM opt-outs into the same picture.
Your own code. The public API has a suppressions resource, alongside contacts, mailboxes and sender-domains [[11]](#sources). If you run your own pipeline, check the API reference for how it is shaped.
A spreadsheet. Exports of up to 5,000 rows download at once, and larger exports, up to 100,000 rows, are prepared in the background [[12]](#sources). That is enough to audit a campaign's leads against your suppression list.

Last, keep the manual case covered. Outlevo's Gmail extension has a recipient guard that warns before you email a contact Outlevo should not reach [[13]](#sources). It is a safety net for one-off replies, not a substitute for the list.

7. Check the sending side before the list goes out

A verified list sent from an unauthenticated domain still lands badly. The mailbox providers publish their own rules:

Google: "email senders who send more than 5,000 messages per day to Gmail accounts must meet the requirements in this section. Set up SPF and DKIM email authentication for your domain." [[14]](#sources)
Yahoo: "Publish a valid DMARC policy with at least p=none" [[15]](#sources)

Setting up authentication is a sensible baseline whatever your volume, because it is the same work either way.

In Outlevo's Smartlead integration, every mailbox must be connected and warmed up before a campaign sends, and its domain must have SPF, DKIM and DMARC checked in the last 7 days [[9]](#sources). If your sending runs through Outlevo's managed mailboxes, a new mailbox sends nothing until it is warm, which is at least 14 days and usually about 3 weeks [[16]](#sources). Each mailbox's warm-up state and reputation are checked daily [[16]](#sources). Managed mailboxes also buy sending domains for you, so you never touch your main domain [[16]](#sources). List hygiene protects mailbox reputation. It cannot replace the warm-up.

8. Set the pause rule before the first send

Most teams ask what bounce rate should stop a campaign. This guide does not give you one number, because the right line depends on your list, your volume and your mailboxes. What matters is that you pick the number before the first send, not while the bounces are coming in.

Write down three things:

The bounce rate at which you pause the campaign, per segment. The catch-all segment can have a stricter line than the verified one.
Who looks at the numbers, and how often in the first days.
What happens after a pause: review the list, remove the bad rows, and only then resume.

Then put the controls where they can act. In Outlevo, nothing is sent outside a policy that a person approved. Policies set who can be contacted, on which channels, how often and with what budget [[17]](#sources). Every external action is checked against the approved policy before it runs, and recorded in a ledger [[17]](#sources). Kill switches pause a campaign, a channel or the whole workspace at once [[17]](#sources). A pause rule you wrote down maps onto those controls: you decide the line, and a person uses the kill switch when a segment crosses it.

Campaign leads are pushed to Smartlead in batches of 100 [[9]](#sources). Separately from that push size, start with a small first send of your own and read its bounces before you add more.

9. Re-check before you reuse a list

A list that was clean last quarter is not clean now. People change jobs, and companies change domains. Before you reuse an old list, run the suppression step again, then re-verify. At 1 credit per check in Outlevo [[3]](#sources), you can work out the cost before you start: multiply your row count by 1 credit.

What to check

Use this as a pre-send checklist.

The list

Every row has a source and a date.
Duplicates and placeholder addresses are gone.
Syntax and domain checks have run, and failures are removed.
Every remaining address has a verification result.
Invalid addresses are on the suppression list, not deleted.

Risky segments

Catch-all addresses sit in their own segment and their own campaign.
Role addresses are out of the automated sequence.
Unknown results are either re-checked or left out.

Suppression

Past hard bounces, unsubscribes and do-not-contact entries are applied before upload.
CRM opt-outs are included where you have a way to bring them in.
Current customers and partners are excluded.

Sending side

SPF, DKIM and DMARC are set on the sending domains.
Mailboxes are connected and warmed up.
Your main domain is not the one carrying the cold campaign. Managed mailboxes are one way to do this [[16]](#sources).

Controls

A written bounce threshold exists for each segment.
A named person watches the first batch.
You know where the pause control is, and who is allowed to use it.

Legal basics List verification is a deliverability step. It is not a permission check, and passing it does not mean you may email someone. Three things worth knowing:

The FTC says of CAN-SPAM: "The law makes no exception for business-to-business email." [[18]](#sources)
In the UK, the ICO says: "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." [[19]](#sources)
GDPR Recital 47 says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." [[20]](#sources)

These are quotes, not legal advice. Ask a lawyer how they apply to the places you send to.

Security Email addresses are personal data. Outlevo encrypts personal data such as email addresses at the field level, and every customer table is protected by row-level security in the database [[21]](#sources). If you keep lists in spreadsheets outside it, treat them with the same care.

Next step

Pick one list and run it through the first six steps this week. Keep the segments separate, write your pause number down, and send a small first batch.

If you want to check what verification costs at your volume, see Outlevo pricing. To compare standalone options, start with the ZeroBounce page and the data and enrichment comparison. To check who belongs on the list in the first place, the free ICP assessment reads up to 5 public pages of your website and returns its findings labeled as verified observations or AI inferences [[22]](#sources).