The email list hygiene checklist for 2026

A clean email list in 2026 is one where every address was verified when it was collected, is re-checked before each large send, excludes disposable and role accounts, and only contains people who still open your mail. Follow the ten steps below in order and your hard bounce rate stays under 2%, your spam complaint rate stays under 0.3%, and Gmail and Yahoo keep putting you in the inbox.

Why hygiene is a process, not a one-off clean

Email addresses decay at around 22% a year. People change jobs, abandon old mailboxes, let domains lapse and forget the alias they used once for a download. On top of that, roughly 15% of addresses collected through web forms are invalid at the moment they arrive: typos, fake entries, bots and throwaway addresses.

A single clean fixes today's list. A process keeps next month's list clean too. Mailbox providers measure you continuously, so the list you send to in December matters as much as the one you cleaned in January.

Since the Gmail and Yahoo bulk sender rules came into force in February 2024, the measurements carry real consequences. A spam rate above 0.3% in Google Postmaster Tools can get your mail rejected, and hard bounces creeping towards 2% of a send trigger throttling. We cover the rules in detail in our sender reputation guide. This checklist is how you stay well inside them.

The checklist

1. Verify every address at the point of capture. The cheapest invalid address is the one that never enters your database. A form validation widget checks syntax, suggests fixes for typos like gmial.com, blocks disposable domains and confirms the domain accepts mail while the person is still typing. Our real-time verification does this in well under a second, and credits are only spent on addresses that pass the free syntax and duplicate checks.

1. Use double opt-in where it fits. A confirmation email proves the mailbox exists and that a human wants your mail. It costs you some signups, so it fits newsletters and communities better than checkout or lead forms. Where you skip it, real-time verification does most of the same job without the drop-off.

1. Clean the whole list before every large send. Anything that has not been verified in the last 90 days should go through a bulk email verifier before a campaign to the full list. Decay does not wait for you. Our bulk list cleaning accepts a CSV, verifies each address with a real SMTP handshake and returns a verdict of deliverable, undeliverable, risky or unknown plus a 0 to 100 score. Duplicates and malformed addresses cost nothing.

1. Remove role accounts and disposable addresses. Addresses such as info@, sales@ and support@ reach a shared inbox, not a person, and are the most likely to report you as spam. Disposable providers hand out mailboxes that die within minutes. Run the list through the role email checker and the disposable email checker, or let the bulk verifier flag both. We explain why in role-based addresses and deliverability and why you should block disposable addresses.

1. Decide a policy for catch-all domains. A catch-all domain accepts mail for any local part, so an SMTP check cannot prove a specific mailbox exists. These come back as risky. Our rule: keep catch-alls that have engaged in the last six months, send to new catch-alls in small batches and watch the bounces, and drop any that bounce. The catch-all checker tells you which domains behave this way, and catch-all domains explained covers the trade-offs.

1. Sunset contacts who have stopped engaging. A verified address that has not opened or clicked in 6 to 12 months is a liability: providers read sustained non-engagement as a signal that your mail is unwanted, and dormant mailboxes are the ones most likely to be recycled into spam traps. Send a short re-permission series, then move anyone who ignores it to a suppressed segment. Keep the record; stop the sending.

1. Monitor bounce and complaint rates on every send. Pull the numbers after each campaign, not once a quarter. Hard bounces above 2% mean the list has drifted; complaints above 0.1% mean content, frequency or consent has drifted. The bounce rate calculator shows where you stand, and how to reduce email bounce rate is the fix list.

1. Authenticate your sending domain. SPF, DKIM and DMARC are now mandatory for bulk senders, and a DMARC policy of at least p=none is the floor. Check your records with the SPF and DMARC checker and fix any domain that your ESP sends on your behalf. Hygiene on the list is wasted if the mail itself looks forged.

1. Keep suppression lists and never import over them. Unsubscribes, hard bounces, complaints and sunset contacts go on a permanent suppression list that every tool you send from respects. The classic failure is a CSV re-import that resurrects a thousand unsubscribed addresses. Use "update existing contacts" on imports and never switch a suppressed contact back to active by hand.

1. Document consent and retention. Under GDPR and similar laws you need to show where each address came from, when, and on what basis. Store the sign-up source, timestamp and IP as contact fields, write down how long you keep inactive contacts, and delete when that period runs out. A documented retention rule also forces the sunset step to actually happen.

A cadence that works

A list that is never cleaned is not a list, it is a bounce rate waiting to happen.

What to do next

Start where the damage is largest. If you have a list that has not been verified this year, export it and run it through the bulk email verifier today. Then stop the next batch of bad addresses at the door by adding the form validation widget to your sign-up forms. A new account comes with 100 free credits, enough to test both on a sample before you commit.