List Verification Suspicion Confirmed

I’ve long suspected that some list verification companies were taking customer lists and not just verifying them, but also using them to send their own mail. This is based on a few interactions, both public and private, I’ve had with various leaders and stakeholders in the space. It’s always been a suspicion, though.

I could have done the work to prove this suspicion, but I didn’t care to invest that much time in it. List verification companies have sold the email industry on the legitimacy of their product. I have more important and useful things to do than arguing with a VC and private equity backed industry that is designed to help send spam.

This week, though, a company called Scrubby.io sent me cold email advertising their new product. They promised to clean up addresses inside catchall domains by “sending a real delivery test to each catch-all.” That caught my eye, because it implies they’re sending actual emails to any addresses given to them.

I responded to the email with one question: “So you take my mailing list and then send mail to the subscribers. What mail do you send them?”

This morning they replied.

We send minimalist test emails through our own burner accounts to observe how the recipient’s mail server responds. This allows us to return a hard valid or invalid result with 98% accuracy without touching your client’s domains.

Yeah, they send messages to your list from burner accounts. That sure sounds like they spam your email addresses just to test to see if the addresses are live.

When working up this blog post, I visited their website. On the About page they say:

In 2020, our founding team was running large-scale outbound campaigns for sales teams across Europe. We kept hitting the same wall: up to 40% of our purchased lead lists were coming back as “unknown” or “risky” from every email verification tool on the market.

As I said in my gambling with cold email blog post, getting addresses that bounce from list sellers is the list seller defrauding you. In that post I mentioned a client getting a 12% bounce rate from a purchased list. This company now says they see a 40% bounce rate from purchased lists. Never fear! Instead of telling the vendor they defrauded you and sold you only a percentage of what you purchased, you can pay this vendor to fix that by sending spam to your purchased list.

Fun with DKIM

Related Posts

Gambling with cold email

I don’t think it’s a secret that I don’t like cold outreach mail. I do not want to receive it. I do not help companies get it delivered.

Read More

Six best practices for every mailer

People get into all sorts of details when talking about best practices. But so much of email depends on the type of email and the target market and the goals of the sender. It’s difficult to come up with universal best practices.
I’ve said in the past that I think that best practices are primarily technical. I don’t believe there is a best frequency or a best time to send mail or a best image to text ratio.
My top 6 best practices every marketer should be doing (and too few are).

Read More

Data hygiene and bouncing zombies

There are a number of folks who tell me there can be no zombie addresses on their lists, they aggressively remove any address that bounces. The problem is that zombie addresses don’t bounce, at least not always. And even when ISPs say they have a policy to bounce email after a certain period of time with no access, that’s not always put into practice.
How do I know that ISPs don’t always deactivate addresses on the schedules they publish? Because I have seen addresses not be deactivated.
I have addresses in a lot of places that I go for long periods of time not checking. It’s rare that they’re taken from me or reject mail – most of the time they’re special test addresses I use when diagnosing issues. This post is based on my experiences with those addresses and how abandoned addresses are treated at some ISPs.
For Gmail I have two examples of addresses not being deactivated.
In July 2011, we set up a test address to look at how Gmail was handling authentication. We sent a matrix of different test emails to it, with valid and invalid SPF and DKIM signatures. We pulled the data from the account. I don’t know for certain when the last time I logged in, but it was August or September of last year. So we have an address that has been dormant since September 2011.
I just sent mail to the account and google happily accepted it.
Mar  2 07:03:22 misc postfix/smtp[11770]: 11CA12DED3: to=<wttwtestacct@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.127.27]:25, delay=1.8, delays=0.25/0.02/0.56/0.93, dsn=2.0.0, status=sent (250 2.0.0 OK 1330700602 x8si8608852pbi.66)
I have another google account (apparently) that my records show I set up sometime in 2010. The login info was saved October 2010. I don’t know when the last time I logged in was, but given I’d forgotten the existence of the account it’s a good bet that it has been more than a year. That account is also accepting mail as of today.
Mar  2 07:06:25 misc postfix/smtp[11836]: 8D90C2DED3: to=<phphendrie@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.127.27]:25, delay=1.6, delays=0.26/0.02/0.68/0.66, dsn=2.0.0, status=sent (250 2.0.0 OK 1330700785 a8si4075740icw.96)
For Hotmail I also have quite a bit of history and information. I signed up for my first Hotmail account in 1997. That was an account I used the address to post to usenet, but I didn’t actually use it for mail. I’d check it occasionally (usually when someone said in the newsgroup that they were going to email me) but it wasn’t an address I used regularly. As I moved from posting regularly in usenet, I started checking that account even less.
For a while, if I went more than 6 months checking my Hotmail account they would make me “re-claim” it. What would happen when I’d log in is I’d get a message along the lines of “well, we disabled this account due to inactivity, do you want it back?” I’d say yes, have to go through the setup process again and it would be my account. Mail was deleted during the disabling, and I am guessing they rejected anything new going to that account. I went through this dance for 4 or 5 years. I even had my calendar set to remind me to login every 6 months or so. There was some sentimental value to the address that kept me logging in. I have that same username at every major free ISP: Gmail, Hotmail, Yahoo and AOL, so it’s “my” address.
About 6 or 7 years ago, that behavior changed. I stopped getting the request to reclaim my account. Instead I could just log in. I’d still have mail (mostly spam as the address is on *lots* of lists and millions CDs). I still check it irregularly. I don’t have any idea when the last time I checked it was, but I think it’s been since at least November and probably longer back than that. Hotmail is still accepting mail for that address as well.
It’s anecdotal evidence, at best, but it ‘s the type of evidence that is acceptable even when it’s anecdotal. There are some addresses that are abandoned for long periods of time at the free mailbox providers and they’re are not all automatically pulled from the ranks of active addresses.
What does this mean for senders? It means that data hygiene has to go beyond just removing addresses that bounce. ISPs are not disabling addresses consistently enough for marketers to be able to trust that all addresses on their list are active just because they are accepting email.
This is the root of the recommendation to put in a hygiene program, this is why senders need to look at who is actually engaged with their brand and make some hard decisions about shooting zombies in the head.

Read More