Buying an email list gives you a database to work from. A purchased file can contain real contacts, generated addresses, outdated records, aliases, catch-all domains, and addresses that were never observed in the first place, and even a list sold as "verified" may look different when another verification system checks it.
A purchased list can still be worth the money, provided you treat the file as a starting point. Whether it pays back depends on what happens between purchase and the first send: which records are actually worth sending to, and what each reachable contact really costs.
In this article, we cover seven steps to get there, from choosing the right list and questioning the vendor's verification claims to re-verifying the data, suppressing existing contacts, ramping up your sending, and measuring the first results.
Key takeaways
- A purchased list mixes observed and inferred addresses. Vendors build them from public profiles, web data, partnerships, submissions and generated address patterns, so a plausible address may never have been confirmed as a working mailbox.
- “Verified” depends on who verified it. In our 10,000-record benchmark on 251 catch-all domains, 11 tools found between 4% and 98.2% of the same 500 real professionals, and one called 640 of 5,000 invented addresses valid (12.8%).
- Buying email lists is legal in the US under CAN-SPAM. Senders need accurate headers, a non-deceptive subject line, ad identification, a physical address, and a working opt-out honored within 10 business days.
- Re-verify before the list touches a sequence. Catch-all servers and secure email gateways are common on company domains: in our Fortune 500 census, 69% of primary domains were catch-all, gateway-fronted, or both.
- Suppress, then ramp in slowly. Remove customers, open opportunities, opt-outs and duplicates, start with a small batch, and stop if bounces or complaints breach your thresholds.
- Judge the list by cost per reachable contact. A $500 list of 10,000 records costs five cents a record, but 25 cents per reachable contact if only 2,000 survive verification and suppression.
What you are actually buying
Before worrying about purchased email list deliverability, it helps to understand what is actually inside the file. A purchased database is usually an aggregation of contact information collected from several sources, and not every record has the same level of certainty behind it.
Some contacts may come from publicly listed business information or professional profiles, while others may come from data partnerships, user submissions, or addresses inferred from a person's name and company.
That distinction matters because an address can look plausible without ever having been observed as a working mailbox. A database containing first.last@company.com, for example, may have generated that address from a naming convention rather than confirmed that the mailbox exists. The same person could therefore appear in two purchased databases with different email addresses, even though both providers describe their data as accurate.
This is one reason a large record count can be misleading. Before you send to a purchased list, you need to establish which addresses represent real, active mailboxes and which are simply plausible guesses. That is where independent verification becomes important.
Where list data comes from
Common sources include web crawling, public professional profiles, data partnerships, self-reported submissions, and address patterns generated from known names and domains.
A provider may combine these sources into one database and then run an email verification process over the resulting records. That can produce a large file, but size should not be confused with coverage of real, reachable contacts.
This is also why buying business email lists from two different sources can produce surprisingly different results. One provider might have observed an address directly, while another generated a likely address from the same person's name and company.
The consequence is straightforward: the file you receive is a starting dataset, not a guarantee that every record represents an active mailbox.
What "verified" means on a purchased list
This is the question to ask before putting much weight on a vendor's "verified" label: verified by what, and how? In most cases, "verified" means that an email verification process returned a positive result at a particular point in time. It does not mean that every possible verification method independently confirmed the mailbox, nor does it tell you how the address behaves on difficult B2B infrastructure such as catch-all domains and secure email gateways.
We tested this directly in a 10,000-record benchmark run in August 2026 across 251 catch-all domains. The dataset held 500 real professionals, represented by roughly ten potential addresses each, plus 5,000 invented addresses at the same domains. Eleven verification tools received the same records.
The tools found between 4% and 98.2% of the same 500 real people. Meaning the same underlying population produced radically different answers depending on which verification system checked it.
The errors split two ways. (1) Million Verifier resolved more of the list than most of the field, and called 640 of the 5,000 invented addresses valid, a 12.8% false-positive rate. (2) Much of the rest avoided that error by not deciding at all, leaving 94% to 96% of records unresolved. Allegrow found 491 of the 500 real people, called 11 invented addresses valid (0.22%), and left 2.0% of the set unresolved.
For a buyer, that gap is the whole question. Two databases can both be described as verified while holding very different numbers of usable contacts, and the invoice rarely says which definition of verified you received.
Is it legal to buy email lists in the US?
Buying email lists and sending commercial email is legal in the US under CAN-SPAM, provided the messages comply with the law's requirements. CAN-SPAM does not generally require prior consent before a commercial email can be sent.
For commercial messages, the FTC requires accurate header and routing information, a non-deceptive subject line, clear identification that the message is an advertisement, and a valid physical postal address. Messages must also provide a working opt-out mechanism, and opt-out requests must be honored within 10 business days.
Once a recipient has opted out, you also cannot sell or transfer that address to another party for marketing purposes. Rules differ outside the US, so anyone sending internationally should check the requirements that apply in the recipient's jurisdiction. With the legal baseline established, the practical question becomes what happens to the list before you send anything.
Seven steps to make a purchased list deliver
Step 1. Buy for fit, not for volume
The first mistake in buying email lists is treating the price per contact as the main number. The more useful calculation is the price per reachable contact. A 10,000-record database at a low unit price is not inexpensive if verification later shows that only a small percentage represents contacts you can confidently reach.
Define the segment before you purchase. Start with the roles you actually sell to, the company size you can serve, and the geography you want to target. A narrow list that matches your ideal customer profile is easier to verify, segment, and test than a broad database assembled simply to maximize the record count.
Before committing to a large purchase, ask for a sample of a few hundred records from your actual target segment. You want to see what the data looks like in the part of the market you intend to email, not in a generic sample chosen by the provider. That small test also gives you a baseline for the next six steps.
Step 2. Ask the vendor three questions before you pay
The fastest way to understand the quality of a purchased list is to ask how its email addresses were verified. First, ask how each address was verified and which verification method or tool was used. Second, ask when the addresses were last checked. Third, ask how catch-all domains were handled.
The answers should be specific. A useful response gives you a named verification method, a date or verification window, and a clear policy for addresses where the server does not reveal whether the individual mailbox exists.
The answer that should stop the purchase is an inability to explain how catch-all addresses were handled. A catch-all domain can accept mail for addresses that do not actually exist, so a server response that says "accept" is not enough to establish that the person has a working mailbox.This matters particularly for business databases, because catch-all servers and secure email gateways are common on company domains and most concentrated at larger companies.
Step 3. Re-verify the entire list before it touches a sequence
Treat the vendor's verification as a claim, not as your final result. Your own verification should happen before a purchased email list enters a sales engagement platform or cold sequence. This creates a clean decision point between the database you bought and the contacts you actually intend to email.
The reason is especially clear on company domains. Our study of all Fortune 500 primary domains found that 235 of 500 (or 47%) behaved as catch-all, while 276 of 500 (55% of them), were behind a secure email gateway. In total, 344 of 500, or 69%, were catch-all, gateway-fronted, or both. The study was a point-in-time measurement of the Fortune 500's primary domains in 2026.
A catch-all domain accepts messages for addresses whether or not the specific mailbox exists. A secure email gateway can also answer verification requests before they reach the underlying mailbox provider. In both cases, a basic SMTP check can be left with an "unknown" or "accept-all" result instead of an answer about the individual address.
That means the verification method needs to do more than ask whether the server will accept a message. It needs to resolve the difficult cases into a conclusive Valid or Invalid result wherever the underlying signals allow it.
This is the gap Allegrow's verification is built for. It combines syntax checks, MX and SMTP validation, and proprietary signals to resolve B2B contacts on catch-all and gateway-fronted domains to a conclusive valid or invalid, instead of passing an ambiguous result back to the sender. Once the list is live in Outreach, Salesloft or HubSpot, Allegrow's Safety Net checks each contact again moments before a sequence step sends, and pauses the risky ones.
Step 4. Segment by what the verification returned
Do not reduce the output to a simple list of "good" and "bad" addresses. The useful structure is three groups: contacts that are Valid, contacts that need a different approach, and contacts that are Invalid. The middle group deserves attention because throwing it away can remove legitimate business opportunities.
For example, info@company.com and sales@company.com can be real, monitored mailboxes without being the personal address of the person you want to reach. Instead of treating every role address as a dead record, use it as a signal to find a named contact at the same company.
The important discipline is to keep unresolved records out of the first send. If your verification process cannot establish a conclusive result, do not turn unresolved records into an email delivery test against your primary campaign.
Step 5. Suppress before you send
Verification answers whether an address is usable. Your CRM answers whether you should be contacting that person in the first place. Before importing the purchased list into a sequence, suppress existing customers, open opportunities, people already in another sequence, previous opt-outs, previous replies, competitors, and duplicate records against your CRM.
This is both a deliverability and a commercial safeguard. A cold sales template appearing in an existing customer's inbox is not just a potential complaint. It can also make the entire purchase look more expensive than it was because you have spent a valuable contact on someone you already had a relationship with. Purchased data should add new prospects to your system, not override the information your system already has.
Step 6. Ramp into the list rather than blasting it
A newly purchased list is some of the highest-risk mail you will send because the recipients have no established relationship with your sender. Start with a small portion of the verified list, monitor what happens, and increase the volume gradually rather than sending to the entire database at once.
If your setup uses multiple mailboxes, split the cold volume across them rather than concentrating the entire list on one sender. More importantly, keep this activity separate from the domain your existing customer conversations depend on. A purchased list should not suddenly become the dominant source of outbound mail from a domain that customers already rely on.
The reason for the gradual ramp is simple. A sudden increase in messages from an unfamiliar sender to a large group of previously uncontacted recipients creates a sending pattern that is very different from your normal business communication. Ramping gives you time to spot problems before they affect the entire list.
Step 7. Treat the first send as a test and act on it fast
The first batch tells you whether the purchased list survived contact sourcing, verification, suppression, and segmentation. Two numbers matter most at this stage: hard bounce rate and spam complaint rate.
A high bounce rate points back to data quality or verification. A high complaint rate can indicate that the audience, targeting, message, or sending approach is creating a problem even when the addresses themselves are valid.
For Gmail traffic, Google recommends keeping your spam rate below 0.10% and never reaching 0.30%. Senders delivering close to 5,000 or more messages a day to personal Gmail accounts must also meet bulk-sender requirements, including SPF, DKIM and DMARC with aligned authentication, and one-click unsubscribe for marketing messages.
Yahoo holds bulk senders to a 0.3% spam-rate ceiling but publishes no volume threshold, so Google's 5,000 figure is not a rule for every mailbox provider. Our guide to Yahoo's bulk sender requirements covers the difference.
If the first batch breaches either the bounce or complaint threshold you have set, stop sending to the rest of the file. Go back to the verification results, identify where the problematic contacts came from, and re-segment the list rather than continuing and hoping the numbers improve. The first send should be a controlled test that tells you whether the database is ready for more volume, not a commitment to send through the entire purchase.
How to tell whether the list was worth the money
The most useful calculation happens after verification, not when you receive the invoice. Calculate your cost per reachable contact by dividing the total list cost by the number of contacts that made it through your verification and segmentation process. That is a far more meaningful price than the vendor's advertised cost per thousand records.
For example, a $500 database containing 10,000 records costs five cents per record. If only 2,000 contacts remain after verification and suppression, the effective cost is 25 cents per reachable contact. A smaller database that costs more upfront can therefore be cheaper to work with if a much larger share of its contacts survives the same process.
The second useful measurement is reply rate against verified contacts, rather than reply rate against the original file size. This keeps list quality separate from the size of the database.
Keep those numbers with the vendor, segment, purchase date, and verification result. When you buy another list, you then have something more useful than a provider's headline accuracy claim: your own historical performance.
Conclusion
A purchased email list is raw material, and most of the work that decides its value happens before the first message: knowing where the data came from, establishing what “verified” actually meant, re-verifying the records, suppressing contacts you should not email, and ramping in slowly enough to see what the list is doing.
Verification has the outsized effect, because every number after it depends on that decision: (1) a real contact wrongly discarded is a lost opportunity, and (2) an invented or inactive address passed as valid carries its error into your sending reputation and campaign metrics. Meaning the cost per reachable contact you calculate at the end is only as accurate as the verification behind it.
If you have recently bought a list, start a 14-day free trial and run up to 1,000 of its contacts through Allegrow before they touch your next sequence, including the catch-all addresses your vendor marked as verified.
Frequently asked questions
Is it legal to buy email lists?
In the US, yes. CAN-SPAM permits buying a list and sending commercial email without prior consent, provided messages carry accurate headers, a non-deceptive subject line, identification as an advertisement, a valid postal address, and a working opt-out honored within 10 business days. Rules differ outside the US, so check each recipient’s jurisdiction.
Is buying an email list worth it?
It can be, if you judge it by cost per reachable contact rather than price per record. A $500 list of 10,000 records costs 25 cents per contact if only 2,000 survive verification and suppression, so a smaller, better-targeted list can work out cheaper once the same process runs on it.
What does “verified” mean on a purchased email list?
Usually that a verification tool returned a positive result at some point. The label does not say which tool, when, or how catch-all addresses were handled. In our benchmark, 11 tools found between 4% and 98.2% of the same 500 real professionals, so the word alone says little about usable contacts.
How do I verify a purchased email list?
Run the whole file through your own verifier before it enters a sequence, using one that returns a conclusive valid or invalid on catch-all and gateway-fronted domains instead of unknown. Then segment by result, keep unresolved records out of the first send, and suppress existing customers and opt-outs.
Will sending to a purchased list hurt my deliverability?
It can, because recipients have no relationship with your sender. Verify first to keep bounces down, suppress existing contacts, and ramp in with small batches from mailboxes separate from your customer domain. For Gmail traffic, Google recommends keeping spam rates below 0.10% and never reaching 0.30%.
.webp)