Email List Hygiene: How to Keep a List That Mailbox Providers Trust

What is email list hygiene?

Email list hygiene is the ongoing practice of keeping your regular sending audience limited to addresses that exist, that agreed to hear from you and that still show some interest. It covers how addresses get onto the list, how bounces and complaints are handled, and when inactive contacts stop receiving campaigns.

It matters for deliverability because mailbox providers judge you partly by who you send to. Mail to addresses that don’t exist, to old abandoned inboxes, or to people who never open anything tells them you aren’t careful about consent or relevance. Yahoo’s sender guidance explicitly asks senders to monitor bounces and inactive recipients and remove invalid addresses promptly, Google sets limits on user-reported spam, and Microsoft tells senders to stop mailing addresses that return permanent failures.

Hygiene often gets treated as an occasional big clean. That helps once. The lasting fix is closing the doors that let bad addresses in, and that’s mostly a data and process question rather than an email one.

Where bad addresses come from

A retailer runs a clean-up in January. By April the bounce rate is creeping up again. The cause turns out to be a nightly sync from the ecommerce platform that re-creates contacts in the marketing tool from old order records, including addresses that had already hard bounced and been suppressed.

That pattern is common. The usual sources of bad data:

• Signup forms without protection. Bots submit forms with real people’s addresses (sometimes thousands at once, a tactic called list bombing) or invented ones. Without CAPTCHA, honeypot fields or confirmation, all of them get added.
• Typos. gmial.com, hotmial.com, a missing letter in a business domain. Some of these domains are registered on purpose to catch mistyped mail.
• Imports. Trade-show scans, event registrations, legacy CRM exports, spreadsheets from a sales rep who left.
• Purchased or rented lists. Mailbox providers and every major email platform treat these as unacceptable. Beyond the consent problem, they often contain spam traps.
• Sync and integration gaps. Suppressions held in one system but not another, so contacts reappear.
• Time. People change jobs and abandon personal addresses. A list that hasn’t been mailed for two years is, in practice, a different list.

Bounces: hard, soft and what to do with each

A bounce is a message the receiving server refuses. The response code tells you why.

Hard bounces are permanent failures, normally 5xx responses such as 550 5.1.1 (the recipient doesn’t exist) or a domain that has no mail server. Suppress these after the first one. There’s no benefit in trying again, and repeated attempts to unknown users are one of the clearest signals of poor list practice. Microsoft’s policy for Outlook.com senders states that senders must stop retrying after permanent failures.

Soft bounces are temporary, normally 4xx responses: a full mailbox, a server that’s down, or the receiver throttling you. Most platforms retry these automatically. The thing to watch is the same address soft bouncing on every send for weeks. At that point treat it as dead and suppress it.

Be careful with one category. A 5xx rejection that mentions policy, reputation or authentication isn’t telling you the address is bad. It’s telling you the receiver doesn’t trust your mail. Those need investigation, not suppression, and they tend to affect many recipients at the same provider at once.

Most email platforms suppress hard bounces automatically. The common failure is elsewhere: the suppression lives only in the email tool, and a CRM sync, an import or an integration adds the contact back. Make sure suppressions travel with the contact record, or at least can’t be overwritten by a sync.

Spam traps

Spam traps are addresses that exist only to catch senders with poor list practices. Nobody signs up with them, so mail arriving at one is evidence that the address was scraped, bought, guessed or kept too long.

There are three broad types:

• Pristine traps were never used by a real person. They’re planted where scrapers will find them. Hitting one usually means a list came from somewhere it shouldn’t have.
• Recycled traps were once real addresses, abandoned, bounced for a long period and then reactivated by the mailbox provider or a trap operator. Hitting one means you kept mailing an address long after it stopped working.
• Typo traps sit on misspellings of common domains.

You can’t reliably identify trap addresses in your list, and anyone selling a “trap removal” service is selling a guess. The only real defense is upstream: confirmed signups, bounce suppression that sticks, and a sunset policy that stops mail to long-inactive addresses before they can be recycled.

Complaints and unsubscribes

A spam complaint is the most direct negative signal a recipient can give. Gmail asks all senders to keep their user-reported spam rate below 0.3% and recommends staying under 0.1%. Yahoo uses 0.3% as its limit too. Our sender reputation guide explains how those rates are measured.

Hygiene work on complaints:

• Suppress complainers immediately. Platforms do this automatically when they receive feedback loop data. Check that the suppression also syncs back to your CRM.
• Make unsubscribing easier than complaining. Gmail and Yahoo require bulk senders to support one-click unsubscribe through the List-Unsubscribe and List-Unsubscribe-Post headers, with a visible link in the message body as well, and to honor requests within two days.
• Don’t hide the link or add steps. A preference center is fine as an option, but a login wall or a “why are you leaving?” form before the unsubscribe completes pushes people to the spam button instead.

Inactive contacts and sunset policies

A sunset policy is a rule that stops regular campaigns going to people who haven’t engaged for a defined period. It’s the most effective hygiene habit, and the one teams resist most, because the list gets smaller.

“Inactive” has to fit your business. A fashion brand mailing three times a week and a B2B software company sending a monthly newsletter should not use the same window. A useful starting point is to look at how long engaged customers typically go between interactions, and set the window comfortably beyond that.

Measure engagement with care. Apple Mail Privacy Protection preloads images for many Apple Mail users, which registers opens whether or not the person read anything. Open-only definitions will count many inactive contacts as engaged. Where you can, use clicks, purchases, site visits, logins or replies alongside opens.

A typical sequence:

1. Define the inactivity window and the signals that count as activity.
2. Build an engaged segment and send most campaigns only to it.
3. Run a short re-engagement series to contacts approaching the window: a plain question, a preference update, an honest “should we keep writing?”.
4. Suppress anyone who doesn’t respond from regular campaigns.
5. Keep them in your CRM. Suppressed doesn’t mean deleted. Their history may still matter for sales, service or reporting.

If you use Klaviyo, our Klaviyo segmentation guide covers how to build engagement-based segments there.

Getting signups right

Clean data at the point of entry saves the most work later.

• Confirmed opt-in (double opt-in) sends a confirmation email and only adds the address once it’s clicked. It stops typos, bots and malicious signups almost completely, at the cost of losing some genuine subscribers who never confirm. Yahoo recommends it. For lead magnets and high-volume consumer forms, it’s worth serious consideration.
• Bot protection on every public form: CAPTCHA, a honeypot field or rate limiting. List bombing can add thousands of real but unwilling addresses in an hour, and every one of them is a potential complaint.
• Inline validation that catches syntax errors and suggests corrections for common domain typos.
• Consent records. Store the source, date and wording of the consent with each contact. It answers compliance questions and makes it possible to trace a bad segment back to the form or import that created it.

Do email verification tools work?

Partly. Verification services check syntax, whether the domain exists and accepts mail, and often whether the mail server will accept the specific address. They’re useful before importing a list you have permission to mail but haven’t contacted for a while, and for real-time checks on forms.

Their limits matter, though. Many business domains are configured as “catch-all”, accepting every address at the SMTP stage, so a tool can only mark them as unknown. Verification can’t tell you whether the person wants your mail, and it can’t reliably detect spam traps. Cleaning a purchased list with a verifier doesn’t make it a consented list.

A hygiene routine

• Every send: hard bounces and complaints suppressed automatically, and synced to the CRM.
• Monthly: review bounce and complaint rates by mailbox provider, check for repeat soft bouncers, and look at which signup sources produce the most bounces.
• Quarterly: run the sunset policy, review your engagement definitions and check that suppressions haven’t been undone by imports or syncs.
• Before any import: confirm consent, verify addresses, and send to the new segment separately, starting small.

If bad records keep returning, the problem is in the data flow between systems. Our CRM data cleanup guide covers how to trace it.