Mailing an Old Email List: A Safe Restart Plan in Five Stages
Mailing an old email list safely takes five stages: confirm you still have permission, verify every address, segment by how recently each person engaged, restart with the most recent segment at low volume, and widen only while bounce and complaint rates stay low. Sending the whole list at once is the one approach that reliably goes wrong, because it combines dead addresses, possible recycled traps and forgotten subscribers in a single spike.
"Old" here means a list that has not been mailed for several months or more: a newsletter that went quiet, a customer database from a previous system, or a list inherited with a business. The steps apply to opted-in and customer lists. Cold prospect lists need their own consent analysis first.
Why old lists cause problems
Three things change while a list sits unused, and each produces a different kind of damage.
| What changed | Effect when you send | Can verification catch it? |
|---|---|---|
| People left jobs or abandoned mailboxes | Hard bounces | Yes, while the mailbox is still rejecting |
| Abandoned addresses reactivated as traps | Trap hits, blocklisting risk | Not reliably; a working trap accepts mail |
| People forgot they subscribed | Spam complaints | No |
Work addresses decay fastest; our post on B2B contact data decay traces the figures that are actually sourced. The trap row is the one most people underestimate. Spam trap operators can reactivate addresses that have been dead for a long time, and our post on how spam traps get on your list explains how recycled traps work. The complaint row is the one verification cannot help with at all.
Stage 1: check you still have permission
Before thinking about deliverability, check whether you are still allowed to send. Questions to answer per segment:
- How did these people join? A sign-up form with clear marketing consent is different from a list of past enquiries or a list that came with an acquired business.
- Does the consent have a time limit? In Canada, CASL's implied consent from a purchase lasts two years, and from an inquiry six months; see CASL and cold email. If the only basis was implied consent and it has expired, that segment cannot be mailed as if it were current.
- Was the list moved between systems? Unsubscribes and suppressions often stay behind in the old tool. Import the old suppression list first, and check every address against it.
- Would people expect to hear from you? Someone who bought once four years ago and never heard from you again may not recognise your name.
If a segment's permission is doubtful, a single re-permission email (Stage 4) is safer than a normal campaign.
Stage 2: verify the whole list
Verify before sending anything, because hard bounces are the first and most visible damage an old list does. A verification pass removes mailboxes that now reject mail and identifies addresses on catch-all domains, which cannot be confirmed either way.
What to do with the results:
- Remove invalid addresses and record them as suppressed, so they are not re-imported from an old export.
- Hold catch-all addresses for a later, smaller batch.
- Remove role addresses such as
info@andadmin@if they were not deliberately subscribed. - Fix obvious typos only if you can be sure of the correction. Otherwise remove them.
For a sense of cost before you start, the verification cost calculator works out a pass at your list size under different pricing models. SimpleVerifier takes CSV uploads up to 100,000 rows, which suits a one-off large clean, but metered tools can be cheaper for a small list you will not reuse.
Stage 3: segment by last engagement
Order the list by the last time each person did something, not by the date they joined. Useful signals, in rough order of reliability:
| Signal | Reliability |
|---|---|
| Purchase, login or reply | Strong |
| Click on a link | Moderate |
| Form submission or sign-up date only | Weak; shows interest at the time |
| Open | Weak; privacy features record opens nobody made |
Open data is particularly misleading for old lists. Our sunset policy guide explains why Apple Mail Privacy Protection makes opens unreliable as a sign of engagement.
Then split into tiers. An example, which you should adjust to your data:
- Tier A: engaged in the last 6 months
- Tier B: engaged 6 to 18 months ago
- Tier C: engaged more than 18 months ago, or no engagement on record
Stage 4: restart with Tier A, low and slow
Begin with your most engaged recipients and a volume well below your old normal. Google's sender guidelines say: "Start with a low sending volume to engaged users, and slowly increase the volume over time", and "Avoid introducing sudden volume spikes if you do not have a history of sending large volumes." A domain that has been quiet for months has little recent history.
The first send should be something Tier A will recognise and want: a clear reminder of who you are, why they are hearing from you, and a prominent unsubscribe link. For Tier C, or any segment with doubtful permission, send a re-permission message instead: one email asking people to confirm they want to stay, followed by removal of everyone who does not.
Stage 5: widen only while the numbers stay clean
Move to the next tier only after the previous one has gone out with low bounces and complaints. Check after each send:
- Hard bounce rate. If it is materially above zero after verification, something in the data is wrong; stop and investigate.
- Spam rate in Google Postmaster Tools. Google asks senders to stay below 0.10% and never reach 0.30%. See the Postmaster Tools guide.
- Unsubscribes and replies. A spike in "who are you?" replies means the tier is too stale for a normal campaign.
If any number moves the wrong way, pause, go back to the previous tier, and treat the next tier with a re-permission message rather than a campaign.
After the restart
Put the list on a schedule so it never goes stale again. Once the list is moving, a lapsed contact becomes a sunset decision rather than a risk you rediscover in two years. Mail regularly, suppress hard bounces immediately, run a sunset policy for people who stop engaging, and re-verify before any campaign that follows a long gap.
The short version
Permission first, verification second, then a staged restart from the most engaged contacts outward. An old list that shrinks by a large share during this process has not been ruined; it has been measured. The contacts that remain are the ones worth sending to.
Common questions
Is it safe to email an old email list?
Not all at once. An old list contains addresses that have died, some of which may since have become recycled spam traps, and people who no longer remember you. Confirm you still have permission, verify the list, and restart with the most recently engaged segment at low volume before mailing older segments.
How old is too old for an email list?
There is no single cut-off, but age and last engagement are the best guides. Contacts who have not engaged in years, or who joined long ago and were never mailed, carry the most risk. Under Canada's CASL, implied consent from a purchase lasts two years and from an inquiry six months, so some old contacts may have no basis at all.
Should I send a re-permission email to an old list?
Often, yes, for segments where consent is uncertain or engagement is long gone. Send one clear message asking people to confirm, then mail only those who do. It shrinks the list, but the people who remain chose to stay.
Does verification fix an old email list?
It removes addresses that now bounce, which is the most immediate danger. It cannot detect spam traps that accept mail, and it does nothing about people who will mark you as spam because they have forgotten who you are. Segmenting by engagement handles that part.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.