Email Horror Stories, part 1 of 3
Your list isn't an asset. It's a graveyard, and mailbox providers are the ones who dig things up.
Every program has one: the file nobody wants to touch. The 2019 petition drive. The rented "likely donors" list a vendor swore was clean. The event sign-ins from a conference three cycles ago. It sits in the ESP, it makes the total look big, and the day someone needs volume, it gets mailed.
Then the bounces show up. This post is about why, and what to do before the next send.
The crypt keeper's ledger
Start with what a healthy program looks like. In its 2026 benchmark, covering 2025 sending, Validity put the average unknown-user rate (what the rest of us call hard bounces) at 1.46% and the average complaint rate at 0.06% (Validity 2026 Email Deliverability Benchmark Report). If your file bounces at 7%, you are not slightly off average. You are mailing people who aren't there.
Dead addresses cost you in two ways. The obvious one is the bounce itself, which mailbox providers read as a sign you don't know who you're mailing. The less obvious one is that old addresses don't always bounce. Some of them get repurposed to catch senders who aren't paying attention.
There is also a clock you don't control. Validity notes that Yahoo closes inactive accounts after 12 months and Gmail after 24, so the longer a segment sits, the more of it turns into hard bounces (same report).
Three kinds of ghosts
According to Spamhaus, most spamtraps fall into three groups: typos, recycled and pristine (Spamhaus on spamtraps).
- Typo traps are misspelled versions of real provider domains, think yaaho.com. Spamhaus ties them to addresses scraped from the web or bought from someone who scraped them.
- Recycled traps are real addresses that were abandoned and later turned into traps. Spamhaus says they make up most traps, and they mostly signal that you stopped cleaning your list.
- Pristine traps were never anyone's inbox. Spamhaus says mail landing in one points to scraped or improperly sourced data, which says something worse about where the list came from.
The distinction matters because the fix differs. Recycled traps are a hygiene problem. Pristine traps are a sourcing problem.
Haunted by a stranger's list
Rented and bought lists are where the pristine traps live. You can't see how the addresses were collected, you can't see how old they are, and you inherit all of it the moment you hit send.
Spamhaus takes a blunt position on this: it urges people to treat spamtraps as proof of a data collection or hygiene issue and not to go hunting for the offending address (Spamhaus). That is hard advice to take at 4 p.m. the week before an election, but it is the right advice. If a vendor can't tell you how a list was built, the list is the risk.
The blocklist tribunal
Blocklists don't care about your intentions. They care about what your mail looks like from the outside: the IP it came from and the domains it links to.
Two habits make this worse. The first is judging a listing by the IP alone. URL blocklists such as SURBL list the domains that appear inside message bodies (SURBL overview), so your link and tracking domains can put you on trial even when your sending IP is spotless. Check them before launch, not after the first deferral. The second is treating a listing as a mailbox-provider problem. Read your bounce logs first. The provider is usually telling you exactly what it saw.
Exorcism by sunsetting
A sunset policy retires addresses that have stopped engaging. Spamhaus says M3AAWG suggests waiting at least 12 months before dormant addresses can age into traps, and that mailbox providers may start investigating unengaged addresses somewhere between 3 and 12 months (Spamhaus on sunset policies, November 2023, so treat the numbers as guidance, not a rule).
Put plainly: if you mailed someone a year ago and they never opened, clicked or gave, they are not a subscriber. They are a liability with a name attached.
In practice, sunsetting is three moves. Segment by last engagement. Send the re-engagement ask to the middle of the pile, once, with a clear way to say yes. Suppress everyone who doesn't answer. Hard bounces get suppressed the first time, every time.
Political and nonprofit programs resist this because list size feels like strength. I'd take a 150,000-address file that people read over a 600,000-address file that bounces at 7%.
Composite scenario: the 2019 petition list
Composite scenario. No real organization or person is depicted. A statewide PAC inherits 600,000 addresses: a 2019 petition drive plus a rented "likely donors" list. Most of them haven't been mailed in years. A pre-election push is two weeks out, and the finance director wants the whole file.
What went wrong:
- Monday: the full file goes out. Hard bounces hit 7%.
- Tuesday: Gmail starts deferring mail.
- Wednesday: a recycled trap gets hit and the sending IP lands on a blocklist.
- Thursday: fundraising links land in spam, even for donors who gave last month.
- Friday: the consultant blames Gmail.
How it should have gone: verify the file at import and drop the rented segment. Send first to people who engaged in the last 12 months, then re-permission the rest or let them go. Check bounce and complaint rates after every send. Before launch, check the link domain against URL blocklists.
Don't be this sender
- You email addresses you can't date.
- You rent lists without asking where the consent came from.
- You never suppress hard bounces or long-dormant addresses.
- You've never checked your link and tracking domains against URL blocklists.
- You blame the mailbox provider before reading your bounce logs.
If two or more of those sound familiar, your list is already haunted. The good news is that exorcisms are cheap compared to a blocklisting the week before Election Day.
Next week: what happens when a cold sender suddenly sends big.
