Email Verification for Agencies Managing Client Email Lists

Agencies should verify every client list at intake, before it touches a sending platform, and report the result per client: rows received, duplicates, valid, invalid and risky. Pass the cost through per list or fold it into the retainer, and get written authorisation to use a verification service before uploading anyone's data.

Agencies have a problem in-house teams do not. You are sending on someone else's list, often from someone else's account, with someone else's reputation at stake. When a client hands over a CSV, you rarely know where it came from, when it was last mailed, or what is in it. Verification is the cheapest way to find out before it becomes your problem.

Why client lists are riskier than your own

A client list arrives with no history you can see, and the consequences of a bad send land on the client's account and your relationship. The sending platforms are explicit about this.

• Mailchimp: its abuse-prevention system, Omnivore, checks addresses the account has not mailed before, on import or send. When the risk is too high, Mailchimp prevents sending to those addresses (Mailchimp help). A new client list imported into a client's Mailchimp account is exactly what Omnivore looks at.
• HubSpot: marketing email is suspended if an account exceeds a 5% hard bounce rate, a 0.1% spam report rate or a 3% unsubscribe rate in a month (HubSpot knowledge base).
• Klaviyo: suppresses hard bounces immediately and soft bounces after more than 7 consecutive failures, and describes a bounce rate under 1% as healthy and over 2% as needing attention (Klaviyo help).

If you send an unchecked client file and trip one of those, the client's account is restricted, and the first question will be what the agency did with their list.

Step 1: intake checks before anything else

Run a fixed intake routine on every client file before verification, so problems are found and documented on day one.

1. Record provenance. Ask the client, in writing, where the list came from, when it was last mailed, and how consent was collected. Save the answer with the file.
2. Count and dedupe. Note rows received and duplicates removed. Our guide to removing invalid and duplicate emails from a CSV has spreadsheet and Python methods.
3. Spot obvious red flags. A list full of info@ and sales@ addresses, or one with no names at all, suggests scraped or purchased data. See should you buy an email list?
4. Then verify.

Step 1 matters because verification cannot fix a consent problem. Spamhaus's marketing FAQ describes removing spam traps and complainers from a non-opted-in list while keeping the rest as "listwashing", and the outcome is still a list without permission. If the provenance answer is vague, that is a conversation to have before you upload anything.

Step 2: get the data processing terms right

Under GDPR an agency is usually the client's processor, and a verification service is your sub-processor, so you need authorisation before uploading. This is the step agencies most often skip. It is not legal advice; check with your own adviser.

Article 28(2) GDPR says a processor shall not engage another processor without the controller's prior specific or general written authorisation. In practice:

• Your client contract or data processing agreement should name verification as a permitted activity, or give general authorisation for sub-processors with notice of changes.
• List the verification provider as a sub-processor, with what it receives (email addresses, possibly names) and how long it keeps them.
• Prefer uploading only the email column. A verifier needs the address, not the client's customer names, order history or notes.

US clients have a parallel concern. The FTC's CAN-SPAM guide states that both the company whose product is promoted and the company that sends the message may be held legally responsible, and that a business cannot contract away its responsibility by hiring another company. Both you and the client have reasons to want the list clean.

Step 3: verify and segment

Verify the deduplicated file and split it into send, test and suppress groups.

Result	What it means	What the agency does
Valid	Mail server confirmed the mailbox exists	Send
Invalid	Mailbox or domain does not exist, or address is broken or disposable	Suppress in the client's platform
Risky	Could not be confirmed, often a catch-all domain	Small test send, then decide
Role address	info@, sales@ and similar	Client decides; flag in the report

Import invalid addresses into the platform's suppression list rather than just deleting them. If the client re-uploads the same old CSV next quarter, the suppression stops the bad addresses coming back. Klaviyo, for example, accepts a suppression import as a CSV with a single email column (Klaviyo help).

Step 4: report per client

Give every client a one-page verification report, because it protects you and shows the work. Keep it consistent across clients so you can compare.

Field	Example
Client / list name	"Spring webinar registrants"
Received	Date, rows
Duplicates removed	Count
Valid / invalid / risky / role	Counts and percentages
Action taken	Sent valid; suppressed invalid; tested risky
Post-send bounce rate	From the sending platform
Provenance note	Client's written answer from intake

The post-send bounce rate is the line clients care about. It turns verification from an invisible cost into a result they can see.

Step 5: decide how to charge for it

Agencies either pass verification through at cost per list or include it in the retainer; the right choice depends on volume and how your tool is priced.

Per-credit verifiers make pass-through simple. DeBounce, for example, sells a 25,000-credit pack for $45 as of October 2026 (pricing), and its credits do not expire, so a 25,000-row client list has a clear cost that can go straight onto the invoice.

Flat-rate tools change the maths. SimpleVerifier is $29.99 a month with no per-email fees, so the cost per list falls as you verify more, but the cost per client becomes an allocation rather than a receipt. A rough break-even against DeBounce's packs:

• DeBounce's 10,000 pack is $25, and its 25,000 pack is $45. The break-even with a $29.99 flat fee sits at roughly 10,000 to 15,000 addresses a month.
• Below that, pay-as-you-go is cheaper. Above it, a flat fee is cheaper, and the gap widens with every re-verification.
• Under about 5,000 a month, EmailListVerify's $16 plan is cheaper than either.

You can run your own numbers with the verification cost calculator or on our pricing page.

Throughput is the other constraint for agencies. SimpleVerifier verifies 45 addresses per minute per account, which is 2,700 an hour. A 25,000-row list takes a little over nine hours. That is fine when lists arrive with a few days' notice, and a real limitation when a client sends a large file on Friday afternoon for a Monday launch. If your clients regularly need large lists turned round in an hour, check the published throughput of any tool you consider and weigh it against the cost per address.

Results are cached for 14 days, so re-running a corrected version of the same client file within that window does not mean re-checking every address from scratch.

Mistakes agencies make with client lists

Most agency list problems come from skipping intake, not from the verifier.

• Merging client lists. Never combine lists across clients, even for testing. It is a data protection problem and it makes per-client reporting impossible.
• Keeping client data after the engagement. Article 28(3)(g) expects processors to delete or return data at the end of the service. Delete your verification exports when the job ends.
• Treating risky as valid to hit a list-size target. Clients like big numbers. Send risky addresses in a separate test batch and report the result honestly.
• Ignoring authentication. A clean list sent from a client domain with broken DMARC still lands in spam. Run the client's domain through the deliverability audit at onboarding.

The takeaway: make verification part of client onboarding, not a rescue step after a suspension. Record where each list came from, get written authorisation, verify before import, suppress the invalid addresses in the client's own platform, and send the client a short report with the before and after numbers.