Verify a B2B list by running syntax, MX, SMTP and catch-all checks before the first send, then holding hard bounces under half a percent.
TL;DR
- Deliverability guidance in 2026 treats a bounce rate above 2 percent as poor list hygiene, and above 5 percent as a blacklisting risk.
- Google asks bulk senders to keep reported spam under 0.10 percent and never to reach 0.30 percent, enforced with outright rejection rather than spam foldering.
- Between 22.5 and 30 percent of B2B email addresses go invalid every year, so a list verified in January is a different list in September.
- Catch-all domains cover roughly a quarter to a third of B2B records, and no SMTP check can resolve them.
- Bulk verification runs from about $0.0037 to $0.008 per address in 2026, which is cheap against the cost of one burned domain.
A verified list is not a cleaner list. It is a list that will not cost you the domain you send from. That is the whole argument, and the arithmetic below makes it.
Why does a bought B2B list bounce?
Because it was accurate when it was collected and nobody collected it recently. B2B contact data decays continuously as people change roles, companies rename domains and mailboxes are retired. The decay is not a defect of one vendor. It is the physics of the category, and it is measurable.
Published 2026 syntheses put annual email invalidation between 22.5 and 30 percent, and Cleanlist's data decay analysis puts overall contact accuracy loss around 22 percent a year. Landbase's compilation reports job title changes at 65.8 percent annually and phone number changes at 42.9 percent, both consulted on September 13, 2026. A monthly rate near 2.1 percent, attributed to MarketingSherpa in the same compilation, compounds to roughly a fifth of the file each year.
That is why a list is a perishable good, and why the question is never whether to verify but how recently.
What bounce rate is actually safe in 2026?
Under 2 percent total, under 0.5 percent on hard bounces, is the working answer for B2B. Mailbox providers now reject rather than filter, so the consequence of crossing the line arrives as a 550 error and a damaged sending reputation instead of a quiet dip in opens.
| Metric | Safe | Warning | Danger |
|---|---|---|---|
| Total bounce rate | Under 1 percent | 2 to 5 percent | Above 5 percent |
| Hard bounce rate | Under 0.5 percent | 0.5 to 2 percent | Above 2 percent |
| Spam complaints (Google Postmaster) | Under 0.10 percent | 0.10 to 0.30 percent | 0.30 percent and above |
| List age since last verification | Under 30 days | 30 to 90 days | Above 90 days |
The bounce thresholds follow 2026 deliverability guidance compiled by EmailAddress.ai and Instantly. The spam figures are Google's own bulk sender guidance, summarised in the 2026 compliance guides from PowerDMARC and Red Sift. The list age row is our own rule, derived from the decay rates above rather than from any vendor.
The five checks a verification pass must run
A complete pass runs five checks in order, each cheaper than the one after it. Syntax rejects malformed addresses for free. Domain and MX lookups confirm the domain can receive mail at all. SMTP probing asks the receiving server whether the mailbox exists. Role and disposable detection strips addresses that will never reply. Catch-all classification handles what is left.
Run them in that order because each one shrinks the set the next one has to pay for. Syntax and MX are essentially free and typically remove a meaningful slice of an old file before you spend anything on SMTP. Instantly's 2026 upload quality guide describes the same sequence as the standard pipeline, with format validation, duplicate detection, MX verification and SMTP mailbox checks as the core.
The check most teams skip is role detection. Addresses like info@, sales@ and contact@ pass every technical test and still produce complaints rather than replies, which is the metric that actually decides your sender reputation.
What does verification cost per thousand addresses?
Between roughly $3.70 and $8.00 per thousand at small volumes, falling under a dollar per thousand at the top tiers. The spread between vendors is smaller than the spread created by how each one bills catch-all and unknown results, which is where the real cost difference hides.
| Tool | Entry price | Cost per 1,000 | Reported accuracy | Charges for catch-all results |
|---|---|---|---|---|
| MillionVerifier | $39 for 10,000 | ~$3.90 | ~96 percent independently, 99 percent claimed | No |
| Bouncer | $37 for 10,000 | ~$3.70 | ~99.1 percent | No |
| NeverBounce | Pay as you go | ~$8.00, ~$3.00 at 100,000+ | ~99.9 percent | Yes |
| ZeroBounce | $99 for 25,000 | ~$4.00, ~$8.00 pay as you go | ~99.0 percent | Extra charge to score them |
Prices and accuracy figures come from two concordant 2026 benchmarks, Instantly's eight-tool test and LaGrowthMachine's verification software comparison, both consulted on September 13, 2026. Vendor pages were not rendered directly, so confirm the current rate before you buy.
The catch-all column is the one to read twice. On a list where a third of records are catch-all, being billed for those results changes the effective price by half.
How do you handle catch-all domains?
You cannot resolve them with SMTP, so you classify them and decide how much risk to carry. A catch-all server accepts mail for every address at the domain, valid or not, which means the protocol gives the same answer for a real mailbox and an invented one.
2026 analyses put catch-all coverage between 23 and 31 percent of B2B databases, with actual deliverability on those records ranging from 40 to 85 percent depending on the domain. Bouncer's approach, reported at 87 percent accuracy in catch-all testing, works by scoring more than 47 signals beyond the SMTP response rather than by asking the server a question it will not answer honestly.
Three workable policies exist. Drop catch-alls entirely, which is the safe choice on a new domain. Send to them from a separate secondary domain, so a bad batch cannot hurt the mailbox you rely on. Or send to the scored subset above a confidence threshold and watch the bounce rate for the first 200 sends. Pick one before the campaign, not after the first bounce report.
What does skipping verification actually cost?
More than verification, by roughly an order of magnitude, and the loss is not the wasted sends. Take a 10,000-row list bought at market rates and left unverified for six months. At a 22.5 percent annual decay rate, about 11 percent of it is already dead.
That is 1,100 hard bounces on a 10,000-send campaign, an 11 percent bounce rate, which is five times the level 2026 guidance treats as dangerous. Verifying the same file at $3.90 per thousand costs $39. The alternative is a burned domain, a warmup cycle of two to four weeks before you can send at volume again, and every campaign in that window postponed. There is no version of the arithmetic where $39 loses.
What changed for list verification in 2026?
Enforcement changed. Bulk sender rules from Google, Yahoo and Microsoft now apply at 5,000 messages a day per domain, and non-compliant mail is rejected outright rather than filtered. PowerDMARC records Google returning 550 errors and Microsoft returning 550 5.7.515 for senders that fail the requirements.
The second change is procedural. DMARC was published as a Proposed Standard, RFC 9989, in May 2026, according to the same 2026 compliance guides. Authentication is no longer a recommendation you can defer while you fix your list. The practical effect for anyone verifying a list is that bounce hygiene and authentication now fail together, since a domain with a poor reputation gets less tolerance on everything else.
A verification pass you can run this afternoon
Export the list. Deduplicate on the address, then on the domain plus person, because vendor exports carry both kinds of duplicate. Strip role addresses and known disposable domains. Run the remainder through a verifier that does not bill you for catch-all results. Split the output into three files, valid, catch-all and invalid.
Send to valid first, at your normal volume, and watch the bounce rate over the first 500 messages. If it stays under 1 percent, add the catch-all file from a secondary domain. Delete the invalid file rather than storing it, since a suppressed address you keep re-importing is how a clean list becomes a dirty one again. Then diary the next pass for 30 days out, because the decay rates above start working the moment you finish.
Where Freelvy sits in this conversation
Freelvy is our product, an AI sales platform. It works the way ChatGPT or Claude does. You describe the customer you want in one prompt, and the agent searches 40+ live sources at query time, maps, official company registries, job boards, storefronts and ad libraries, rather than filtering a stored database. It then enriches every row with verified contact data, six providers in cascade for emails and nine for phone numbers, and writes and sequences the outreach from the same brief.
The verification question changes shape when the data is fetched at query time rather than read from a warehouse. A row that fails verification is never delivered and never billed, so the file you receive has already been through the pass described above. The published credit catalogue prices a verified email at 3 credits and a verified phone at 15, and plans start at €49 per month for 1,500 credits with unlimited team members. An existing CSV can be pushed through the same waterfalls, which is the cheaper move when you already own the list. There is a free 7-day trial, no credit card, at freelvy.com.
How we verified these numbers
Bounce thresholds, catch-all shares, verification pricing and accuracy scores come from at least two concordant 2026 analyses each, linked inline and consulted on September 13, 2026. Our web access on the day was restricted to search, so vendor pricing pages were not rendered directly and every price should be confirmed at the source before purchase. The 10,000-row cost comparison and the 30-day re-verification rule are our own arithmetic on the published decay rates, not figures anyone else reported.
FAQ
What bounce rate is acceptable for cold email?
Under 2 percent total and under 0.5 percent on hard bounces is the working standard in 2026. Above 5 percent carries a real blacklisting risk. Strong senders sit under 1 percent. Mailbox providers now reject non-compliant mail outright, so the penalty arrives as a hard failure rather than a slow decline.
How often should a B2B list be re-verified?
Every 30 days for a list in active use, and always before a campaign if the file is older than 90 days. With annual decay between 22.5 and 30 percent, a quarter of a stale file can be dead. Verification is cheap enough that frequency costs less than a single bounce incident.
Should you send to catch-all addresses?
Only from a secondary domain, and only after your valid segment has proved a bounce rate under 1 percent. Catch-all servers accept mail for any address, so SMTP cannot confirm the mailbox exists. Reported real deliverability on those records ranges from 40 to 85 percent depending on the domain.
Which email verification tool is the most accurate?
2026 benchmarks put NeverBounce highest at around 99.9 percent, with Bouncer near 99.1 and ZeroBounce near 99.0. MillionVerifier claims above 99 percent and tested closer to 96 percent independently. The gap between the top tools is small enough that catch-all billing policy matters more to total cost.
Does verification stop emails landing in spam?
No. Verification stops bounces, which protects the sender reputation that decides placement. Spam placement is driven by authentication, complaint rate, content and sending patterns. Both matter, and a clean list with no DMARC record will still struggle. Our cold email deliverability checklist covers the other half.
Can you verify emails for free?
Small volumes, yes. Most vendors offer 100 to 1,000 free credits, and syntax plus MX checks can be run with open tooling. Free tiers rarely include catch-all scoring, which is the part that needs real infrastructure. At $3.70 to $8.00 per thousand, paid verification is not the line item worth optimising.
What is a role address and why remove it?
An address tied to a function rather than a person, such as info@, sales@ or support@. They pass every technical check and still produce complaints instead of replies, because nobody owns the inbox. Removing them protects the complaint rate that Google measures at 0.10 percent tolerance.
Sources and methodology
All pages below were consulted on September 13, 2026. Figures from third-party benchmarks are attributed in the text. Cost comparisons and the re-verification interval are our own calculations on those published rates.
- https://instantly.ai/blog/email-list-validation-upload-quality-checks/
- https://instantly.ai/blog/2026-email-verification-benchmark-accuracy-scores-for-8-top-tools/
- https://lagrowthmachine.com/email-verification-software-2026/
- https://www.emailaddress.ai/blog/email-bounce-rate-benchmarks-2026
- https://powerdmarc.com/bulk-email-sender-requirements/
- https://redsift.com/guides/bulk-email-sender-requirements
- https://www.cleanlist.ai/blog/2026-01-22-b2b-data-decay-statistics
- https://www.landbase.com/blog/data-decay-rate-statistics
- https://freelvy.com/pricing
Next in this cluster: the cold email deliverability checklist, the best AI prospecting tools of 2026, and what data quality costs on a database, in our Apollo pricing breakdown.