How we validate emails before a cold outreach send (our current checklist)
Sharing our actual process since most "clean your list" advice online is pretty vague and skips the order that actually matters.
Before any cold outreach send, we run every address through these steps in this specific order:
-
Syntax + MX/DNS check first. This is the cheapest check to run and kills obvious garbage instantly typos, missing @ symbols, domains with no mail server configured. No point spending API credits or SMTP time on addresses that fail here.
-
SMTP-level verification next. This is where you catch invalid mailboxes, not just invalid domains. A domain can have working MX records while the specific mailbox doesn't actually exist. This step is slower and costs more per check, which is why it comes after the cheap filter, not before it.
-
Flag catch-all and disposable addresses separately don't auto-reject them. This is the step people get wrong most often. Catch-all domains accept any address technically, so they'll pass a basic check as "valid" even when the mailbox doesn't exist. Disposable addresses are a different risk category entirely (real mailbox, short lifespan). Both deserve their own bucket and their own threshold, not an automatic reject.
-
Re-validate before every send, not just at signup. This is the one most teams skip. Lists decay fast especially B2B lists, where people change jobs constantly. An address that validated clean three months ago can easily be dead today. If you're only validating once at collection, you're flying blind on anything older than a few weeks.
The order matters more than which tool you use cheap filters first, expensive checks later, uncertain results segmented rather than auto-rejected.
We run this through Gmalogic Email validation api since we built it to solve this exact workflow, but the process itself works with any validator that gives you enough categories in the response to act on.
What's missing from this? Would love to hear what other early-stage teams do differently, especially around re-validation cadence how often is "often enough" for you?
