How to verify a lead list before you send a single email

By 67Leads Team · Published 5 Nov 2026 · Updated 5 Nov 2026 (US Central) · 7 min read

To verify a lead list before you send, check the rows first and the emails second: confirm each business is the trade you want, remove duplicates and dead websites, separate shared inboxes, then run a mailbox check and keep catch-all domains apart. In the 67Leads warehouse today 7,074 emails are mail-server confirmed and 7,369 sit on catch-all domains that can be neither confirmed nor ruled out.

Key numbers

7,074Email confirmed by the mail server
7,369Catch-all email, not confirmable
51%Catch-all share of verified-or-catch-all emails
2%Share of found emails the mail server refused

Live from the 67Leads warehouse, computed 5 Nov 2026 (US Central) when this page was served. Sellable means graded as the trade, with a phone, opted-out businesses removed. Methodology.

Why "verified" stopped meaning much

Buyers who have been burned describe the same thing in different words. "28% invalid. Almost 1 in 3," wrote one agency about a client's "verified" list (r/coldemail). Another described watching a vendor's "verified" emails "bounce same day. Like 18% gone before lunch" (r/smallbusiness). A third reported a bounce rate "floating around 9%" even after running a vendor's list through a verifier (r/agency).

The sharpest version of the complaint is about time: one commenter said a large database's verification "is basically a timestamp" from whenever the data was collected (r/coldemail). Businesses open, close and change addresses all the time. US Bureau of Labor Statistics data shows about 323,000 to 338,000 establishment openings in each of the last two quarters of 2025 and about 310,000 closings in the second quarter (BLS Business Employment Dynamics), against about 8.4 million employer establishments in Census County Business Patterns (Census CBP). Roughly speaking, more than one in ten business locations turns over in a year. A list checked last year is not a list checked.

So verification is not a label you trust. It is a set of checks you can see, with a date on each.

Step 1: Check that each row is the business you want

Email verification tells you whether an address accepts mail. It says nothing about whether the business behind it is your customer. As one commenter put it: "Verification tells you if the email is sendable, but it doesn't tell you if the business row is actually good" (r/coldemail).

Read 20 random rows and ask:

Is every one the trade you asked for? A search for tree services returns plant nurseries, landscapers and firewood sellers too.
Is it a local business, or a franchise head office, a software company or a supplier to the trade?
Is the website a real company site, or a directory profile, a booking link or a social page?

If more than one or two of the 20 are wrong, the whole list needs grading before you send. In our data, 8% of collected listings were a different kind of business; the off-trade count by trade shows where it is worst.

Step 2: Remove duplicates

The same business turns up under several searches and several spellings. Phone number is the most reliable key for a local business: de-duplicate on it first, then on the website domain, then on name plus city. Two rows with the same phone are one business, even if the names differ slightly.

Step 3: Drop or re-route businesses whose website is down

If the website does not load, the email on it is suspect and the business may have closed. Of the 109,838 businesses in our warehouse with a listed website, 7,627 (7%) did not load when last checked. You can check any one with the website down checker. For a web designer these are prospects; for everyone else they belong in a phone list, not an email list.

Step 4: Separate shared inboxes from named ones

Shared inboxes such as info@, office@ and contact@ are real and deliverable, but they are read by whoever is on the desk. Put them in a separate campaign with a message written for a gatekeeper, or skip them when you need the owner. In our warehouse 97% of verified emails are not shared inboxes.

Step 5: Run a mailbox check, and understand what it tells you

A mailbox check, often called SMTP verification, asks the receiving mail server whether a specific address exists, without sending an email. There are four possible answers:

Result	What the server said	What to do
Valid	The mailbox exists and accepts mail	Send
Invalid	The server refused the address	Remove it
Catch-all (risky)	The server accepts every address, so the check cannot tell	Send separately, at low volume, or skip
Unknown	The server did not give a clear answer	Re-check later, or skip

Two points that trip people up:

Catch-all is not valid. A catch-all server says yes to anything, including addresses that do not exist. One cold emailer found "about 60%~70%" of a list marked catch-all (r/coldemail). A sensible practice is "catch-all = lower confidence, separate campaign, lower volume" (MapsLeads).
Valid does not mean read. "Verified only means the email exists. It does not guarantee the owner actually uses that inbox" (r/coldemail).

Here is how the email statuses split by trade in the 67Leads warehouse today:

Trade	With email	Verified	Catch-all	Invalid	Not shared inbox
Tree service companies	14,752	42%	41%	4%	74%
Plumbers	3,408	1%	1%	under 1%	52%
Roofing contractors	3,519	2%	6%	under 1%	43%
Dentists	3,161	0%	0%	0%	46%
HVAC contractors	3,730	12%	17%	2%	48%
Electricians	2,994	under 1%	under 1%	0%	53%
Med spas	2,511	0%	0%	0%	41%
Law firms	2,706	0%	0%	0%	62%
Cleaning companies	2,819	0%	under 1%	0%	49%
Insulation contractors	1,310	24%	36%	3%	55%
Pest control companies	1,449	under 1%	under 1%	under 1%	48%
Chiropractors	1,874	0%	0%	0%	61%

Step 6: Never verify guessed addresses

A common trick is to take an owner's name, generate patterns such as first@, first.last@ and flast@, and keep whichever one the mail server accepts. Do not. US law makes it an aggravated CAN-SPAM violation to send an otherwise unlawful message to addresses "generated by combining names, letters, or numbers into numerous permutations" (15 USC 7704). A verifier makes a guessed address look real; it does not make it a published one. Our guide to whether buying an email list is legal covers the rest of the rules.

Step 7: Check your own sending setup

A clean list sent from a badly configured domain still lands in spam. Gmail and Yahoo require bulk senders to authenticate with SPF/DKIM and publish a DMARC record, and have issued permanent rejections to non-compliant mail since November 2025 (Red Sift). Check your domain with the free SPF and DMARC checker.

Step 8: Send a small batch first

Send to the first 50 to 100 valid addresses and wait a day. If bounces are low and replies arrive, scale up. If bounces are high, stop and go back to step 5, because something in the list or the check is wrong.

A checklist to copy

Read 20 random rows for trade fit.
De-duplicate on phone, then domain, then name and city.
Remove rows whose website does not load.
Split shared inboxes from named addresses.
Mailbox-check every address and record the date.
Keep catch-all addresses in their own, smaller campaign.
Remove every address you or your vendor generated from a name pattern.
Check SPF, DKIM and DMARC on your sending domain.
Send a test batch before the full list.

How 67Leads does this for you

Every 67Leads row has been graded against its trade, de-duplicated on phone, and checked for opt-outs. Emails are read from the company's own site, never generated, then checked over SMTP by asking the mail server whether the mailbox exists, with nothing sent. A row is marked valid only when the server confirmed it; catch-alls are marked risky and filtered out by default. The methodology and how it works pages describe each step, and the email coverage study publishes the counts by trade.

Questions

What bounce rate is acceptable for cold email?

As low as you can get it; there is no single official threshold. The cold email calculator assumes 2% by default. If a test batch bounces far above that, stop and re-check the list.

Should I send to catch-all emails?

Only separately, at low volume, after your confirmed addresses. A catch-all server accepts every address, so a check cannot tell you whether the mailbox is real.

How often should I re-verify a list?

Before every campaign if the last check is more than a few weeks old. Businesses open and close constantly, and a check is only as good as its date.

Get 67 leads free

No card. Search is free with contacts masked.