How to Audit a Purchased or Scraped B2B Email List Before You Send a Single Email

Every B2B list arrives with a promise attached. The data vendor says it is verified. The enrichment tool shows a green tick next to each address. The scraper says it found the email on the company’s own website. The spreadsheet looks tidy.

None of that tells you what will happen when you hit send.

Lists from outside your own signup forms carry risks that your own data usually does not: addresses guessed from a naming pattern, contacts who left the company a year ago, role inboxes, recycled addresses, and the occasional spam trap. “Verified” on a vendor’s list usually means it passed a check at some point in the past, often a simple one, on a date you do not know.

This article is a practical audit you can run on any external list before the first email goes out. It is written for cold outreach and B2B marketing teams, and it assumes you have already decided the list is worth using. Whether you should be buying lists at all is a separate question, covered briefly at the end.

Step 1: Establish Where the List Came From

Before you look at a single address, find out how the data was produced. The answer changes how much you should trust it.

Ask the vendor, or your own team, four questions:

1. Was each address found, or generated? Found means it appeared somewhere public, such as a company website or a published document. Generated means it was built from a name and a domain using the company’s likely pattern, such as firstname.lastname. Generated addresses are much riskier.
2. When was it last checked? A verification run six months ago tells you little about today. B2B data decays continuously as people change jobs, and our breakdown of email list decay explains why.
3. What did “verified” mean? A syntax check, a domain check, and an SMTP mailbox check are very different things. Many vendors mark catch-all addresses as valid because the server said yes.
4. Has the list been sold to others? A list that many senders have mailed is more likely to contain addresses that have become complaints or traps.

If nobody can answer these, treat the whole file as unverified and plan the rest of the audit accordingly.

Step 2: Fix the Structure Before You Validate

Validation tools work on addresses. Before you upload, make sure the file is clean enough that every row is a real candidate.

• Split combined fields. Some exports put two addresses in one cell, or include a name inside the email field.
• Trim whitespace and stray characters. Leading spaces, trailing commas and quote marks are common in scraped data.
• Lowercase the domain part. It avoids duplicate records that differ only in case.
• Remove obviously malformed rows. Missing @ signs, missing domains, and placeholder values such as “n/a”.

Then deduplicate. Purchased lists often contain the same person several times, under slightly different addresses or different job titles. Our guide to deduplicating email lists and normalising aliases covers the edge cases.

Step 3: Flag the High-Risk Categories

Some addresses are risky whether or not they technically exist. Flag these before validation so you can decide how to treat them.

Role addresses. info@, sales@, admin@, support@ and similar. They often reach a shared inbox, rarely reach a decision maker, and are more likely to generate complaints. See our guide on whether to validate or remove role-based addresses.

Free mailbox providers on a B2B list. A personal Gmail or Outlook address on a list sold as “decision makers at mid-market companies” is a sign the data was matched loosely. Some may be real. Treat them as a separate segment.

Disposable domains. These should never appear on a B2B list. If they do, the source is suspect. Our guide to detecting disposable email addresses lists the patterns.

Possible spam traps. You cannot identify traps with certainty from the outside, but old, generic-looking, or long-abandoned addresses carry more risk. Our article on spam traps and how to avoid them explains the different kinds.

Step 4: Run Standard Validation

Now run the whole file through a validator. Standard validation checks syntax, confirms the domain exists and accepts mail, and asks the mail server whether the mailbox exists, without sending an email.

You will get back roughly four groups:

On Scrubby, Quick Verification handles this pass at 1 credit per email.

Look at the proportions as well as the individual results. A list where a large share comes back invalid is telling you something about the source, not just about those rows. That is worth raising with the vendor before you use the rest of their data.

Step 5: Resolve the Catch-All Segment

This is the step most audits skip, and it matters more on B2B lists than on any other kind.

A catch-all server accepts mail for any address at the domain, real or not. Standard SMTP checks cannot tell a real mailbox from a guessed one on these domains, because the server says yes either way. That is why validators return them as Catch-All, Risky or Accept-All instead of valid or invalid. Our walkthrough of where SMTP verification fails covers the mechanics.

On purchased and generated lists this segment is especially dangerous. A vendor that builds addresses from a naming pattern can produce a perfectly formatted address for someone who does not work there, at a domain that will happily accept it. Many vendors then label that address verified.

You have three options:

1. Drop the segment. Safe, but on B2B lists it can mean losing a large share of the contacts you paid for.
2. Send to it carefully. Small batches, separate from your main sends, with close bounce monitoring. This still risks your reputation.
3. Resolve it. Scrubby’s Deep Verification sends real email and observes how mail servers respond over 72 hours (first results in 24 hours, final verdict in 72 hours) for catch-all and risky addresses a quicker check cannot settle, at 3 credits per email. Upload only the segment your first pass flagged, not the whole file.

Step 6: Score Freshness and Fit

Validation tells you whether an address exists. It does not tell you whether the person is still in the role the list says they hold.

Before sending, spot-check a sample of contacts against their current LinkedIn profile or company website. If a meaningful number have moved on, the job titles in the rest of the file are probably stale too, and your personalisation will be wrong even where the address works. For large lists, an enrichment step that refreshes titles is worth considering.

Step 7: Start Small and Watch the Signals

Even after a full audit, do not send the whole list at once.

• Start with a small batch from your best-scored segment.
• Watch hard bounces and complaints for each batch. The thresholds Gmail and Yahoo publish for complaints are low, and our guide to keeping your spam complaint rate under the thresholds explains where the lines are.
• Suppress immediately. Every hard bounce, unsubscribe and complaint goes on your suppression list before the next batch.
• Stop if the numbers move. A rise in bounces on later batches often means a section of the list came from a weaker source.

Should You Be Buying Lists at All?

That is a judgement for your team and your legal advisers. Rules on unsolicited email differ by country, and some regimes require consent or a legitimate interest basis for B2B outreach. A list you bought does not transfer the vendor’s compliance to you. Whatever you decide, the audit above is the minimum before sending, because the reputation you put at risk is yours, not the vendor’s.

The Takeaway

An external list is a set of claims, not a set of facts. Establish where it came from, fix the structure, flag the risky categories, validate everything, resolve the catch-all segment rather than trusting a vendor’s green tick, check that the people are still in their roles, and start with small batches.

Scrubby gives you 200 free credits to test a sample of any list before you commit. Run a Quick Verification pass, then send the catch-all and risky results through Deep Verification, and you will know what the list is really worth. See pricing for credit costs.