A campaign is ready, the segmentation looks right, and the Salesforce send appears routine. Then the bounce report arrives, Account Engagement shows conflicting prospect statuses, and HubSpot contains contacts who already unsubscribed in another system. The problem isn't usually one bad import. It's the accumulated result of stale records, broken synchronisation, unclear consent ownership, and automations that keep recycling questionable contacts.
For B2B teams, email list cleaning is a RevOps control, not a quarterly spreadsheet exercise. It connects CRM data quality with sender reputation, sales productivity, reporting accuracy, and the ability to honour CASL and CCPA obligations. The practical objective is simple: make every send depend on a trustworthy record, a defensible consent trail, and a clear suppression decision.
Why B2B Email Lists Fall Apart
A marketing operations manager facing a 40 percent bounce rate on a Salesforce campaign has more than a deliverability problem. The report usually signals failures that have accumulated across the revenue system, from inconsistent acquisition data to automations that keep treating questionable records as marketable.
Role addresses such as info@, sales@, and support@ enter through forms, list purchases, partner files, and event registrations. Free-mail personas can hide whether a record represents a genuine business contact. Titles become stale after reorganisations, while acquisitions bring shadow CRM imports with different field conventions and incomplete consent history. One prospect may appear in Salesforce, Account Engagement, and HubSpot with different email formats, owners, or lifecycle stages.
The operational cost exceeds the bounce report
Each defect creates a separate downstream cost:
- Sender reputation: Invalid addresses and repeated bounces lower the quality of the audience visible to the sending platform.
- Compliance exposure: Broken consent trails make it harder to prove why a Canadian or California recipient was eligible for a commercial message.
- SDR waste: Sales representatives spend time researching dead accounts, duplicate contacts, and people who no longer hold the recorded role.
- Forecast distortion: Duplicate or unresponsive records can inflate MQL counts and make conversion reporting appear healthier than the underlying funnel.
Unengaged contacts also age into riskier segments when no lifecycle rule removes them from active sending. A contact may remain technically mailable while producing little engagement, increasing the chance that a campaign reaches an address that has changed hands.
Start with the failure chain
Do not begin by deleting records. Trace how data entered the system, how it moved between platforms, which system owns consent, and which automation can reactivate a suppressed contact. Teams researching their market or building investor-facing audiences may use a structured directory such as US seed investors, while still validating acquisition source and permission before importing contacts.
A repeatable audit path inventories sources, normalises fields, deduplicates identities, validates addresses, applies suppression, and monitors the next send. This sequence separates repairable data defects from contacts that should never return to the active audience. It also connects data quality with CASL and CCPA compliance, rather than treating hygiene as a deliverability task alone.
Set the Goals and Scope of Your List Audit
A RevOps lead should define the decision criteria before running a dedupe job. “Clean the list” isn't measurable enough. A useful audit brief might target hard bounces under two percent, inbox placement above 90 percent on seed tests, or restored explicit consent for every EU and Canadian contact. Those targets are operating objectives, not universal guarantees, so document which audience, sender, and campaign they apply to.
Write the audit brief first
Record the following before exporting data:
- Business outcome: Decide whether the audit supports a product launch, database migration, lifecycle campaign, or recurring hygiene process.
- Owner: Name the person accountable for decisions, exceptions, approvals, and rollback.
- Send window: Record the target send date so validation and suppression checks happen close enough to launch to remain useful.
- Audience definition: Specify accounts, regions, lifecycle stages, contact types, and campaign purpose.
- Legal scope: Mark whether CASL, CCPA, or another consent regime applies to the segment.
California privacy obligations deserve explicit treatment. The CCPA, strengthened by the CPRA effective in January 2023, treats email addresses as personal information and gives consumers rights to access, delete, and opt out of sale or sharing. For organisations that meet the law's thresholds, relevant thresholds include annual gross revenue over $25 million, buying, selling, or sharing information from 100,000 or more California consumers, households, or devices annually, or deriving 50 percent or more of revenue from selling or sharing California consumers' personal data. California email list cleaning and CCPA compliance explains why suppression hygiene and request tracking belong in the same operating process.
Map every source of truth
Inventory Salesforce Leads and Contacts, Account Engagement prospects and lists, HubSpot static and active lists, manually uploaded CSVs, enrichment files, event exports, and partner appends. For each source, map:
- Email and alternate email fields
- CRM ID and marketing platform ID
- Account, company domain, and owner
- Campaign membership and lifecycle stage
- Opt-in source, consent status, and consent timestamp
- Bounce, complaint, unsubscribe, and deletion indicators
Don't assume the newest record is the most authoritative. A recent import may contain current job information but no consent provenance, while an older CRM record may hold the only defensible opt-in history. Give the audit team a documented precedence rule before merging or overwriting fields.
Deduplicate and Normalize Contacts Across Systems
Deduplication is an identity decision, not merely a search for matching email strings. The same person can appear with uppercase characters, whitespace, an old corporate domain, or a personal address. Two people can also share a role inbox, which means an email-only merge may destroy account coverage or consent context.
Apply platform-specific matching rules
In Salesforce, combine Duplicate Rules and Matching Rules on the Contact object. Decide whether the campaign needs account-level matching for enterprise accounts, where several contacts belong to one buying group, or contact-level matching for an SMB audience, where the individual record drives outreach. During a merge, retain the most recent explicit-consent record only when the provenance is clear, and preserve the surviving record's campaign, service, and ownership history.
HubSpot needs a similar decision, but the available signals differ. Use Operations Hub workflows or equivalent data operations to compare normalised email, phone, and company domain. Variants such as acme.com, Acme Inc., and acme.co.uk shouldn't automatically become one company without an account-matching rule. A domain can represent a subsidiary, a regional business, or a parent organisation.
Account Engagement creates a distinctive risk. Two Engagement Studio programs can enrol the same prospect when entry criteria rely on overlapping lists rather than a stable CRM identifier. Suppress or branch by CRM ID, and inspect the connected campaign and automation rules before allowing a merged prospect back into nurture.
A strong CRM data hygiene process should also define the survivorship logic, audit fields, and rollback method before bulk changes run.
Standardise before you compare
Use lowercase email values, trimmed whitespace, a single-line street address, ISO country codes, and a controlled vocabulary for titles. Don't convert every title to a generic label and call the record clean. Preserve the original value in an audit field, then map variants such as “VP Marketing”, “Vice President, Marketing”, and “Marketing Director” to reporting categories without erasing useful detail.
| Platform | Dedupe Tool | Match Key | Normalization Step |
|---|---|---|---|
| Salesforce | Duplicate Rules and Matching Rules | Email, account, phone, and CRM context | Lowercase email, standardise title and country |
| HubSpot | Operations Hub workflows and record review | Normalised email, phone, and company domain | Trim fields, align company naming, preserve source |
| Account Engagement | CRM ID controls, automation rules, and list logic | CRM ID plus prospect email | Normalise email and prevent overlapping enrolment |
After the merge, test synchronisation in both directions. A clean Salesforce Contact that fails to update its Account Engagement prospect can still reappear as an apparent duplicate in the next campaign.
Validate Addresses at the Syntax, Domain, and Mailbox Levels
Treat validation as three separate decisions. A vendor result that says “valid” doesn't replace a review of consent, audience fit, or suppression history.
Syntax comes first
Syntax validation catches missing characters, malformed domains, whitespace, and other formatting defects. Use platform validation rules where practical, then supplement them with regex and business rules that flag role addresses such as info@, sales@, and noreply@. Role addresses aren't automatically invalid, particularly in B2B, but they need a separate segment because ownership, consent, and engagement often belong to a team rather than one person.
In Salesforce, route a failed format check to a review queue instead of allowing the record into a sendable campaign. HubSpot can use a property such as email_validation_status, while Account Engagement can use a prospect field that prevents programme entry. Store the original value and the validation timestamp so a later analyst can distinguish a corrected typo from an unverified import.
Domains reveal a different class of error
Domain validation checks whether the domain appears operational and whether its mail-routing configuration supports delivery. It can identify obvious typosquats such as gmial.com and dead corporate domains after an acquisition or rebrand. A domain that resolves doesn't prove that a particular mailbox exists, so don't treat domain success as mailbox confirmation.
Mailbox validation can use SMTP RCPT TO probes to determine whether a server appears to accept a recipient. Catch-all domains may accept any address and return an unknown result, so classify them as ambiguous rather than safe. The practical response is a risk field, not indiscriminate deletion.
Practical rule: Unknown is a routing decision. Send it through review, tighter segmentation, or a controlled test. Don't convert uncertainty into a permanent delete.
Map results back to revenue operations
Use statuses such as Valid, Invalid, Risky, and Unknown. Let those statuses influence Salesforce lead score, HubSpot workflow branches, Account Engagement suppression rules, and sales task creation. A valid mailbox still requires permission, and an unknown mailbox may be a valuable account contact that needs a human decision.
| Layer | What it checks | Typical B2B catch rate | Latency | CRM/automation impact | Catch-all handling |
|---|---|---|---|---|---|
| Syntax | Format, characters, and obvious typos | Formatting defects and malformed entries | Fast | Block or route before import | Not applicable |
| Domain | Domain existence and mail-routing readiness | Dead and mistyped domains | Fast to moderate | Flag domain risk and review account | Keep separate from mailbox status |
| Mailbox | Apparent recipient acceptance | Unreachable or risky mailboxes | Moderate | Set validation status and suppression logic | Mark unknown or risky |
For campaign readiness, use a validation target of at least 95 percent delivery, under 1 percent bounce, and spam complaints below 0.1 percent, based on Customer.io's deliverability metrics guidance. Provider-level reporting generally needs at least 1,000 emails sent before it becomes statistically visible, so pre-send validation remains valuable when a segment is too small for stable reporting.
Manage Suppression Lists and Re-Engagement Programs
Suppression and re-engagement solve opposite problems. Suppression protects recipients and sender reputation by stopping the wrong contacts, while re-engagement gives potentially valuable contacts one controlled opportunity to demonstrate continued interest.
Build a master suppression model from four inputs:
- Hard bounces: Add addresses that the sending platform identifies as permanently undeliverable.
- Spam complaints: Block future promotional sends unless a documented compliance process says otherwise.
- Manual unsubscribes: Treat a direct removal request as authoritative, even when another system shows engagement.
- Role addresses: Hold team inboxes in a separate segment until ownership and campaign purpose are clear.
Synchronise suppression bi-directionally across Salesforce, Account Engagement, and HubSpot. A contact unsubscribed in HubSpot shouldn't become sendable because a legacy Salesforce campaign member was imported into Account Engagement. Keep the suppression record persistent, with source, timestamp, reason, and the process that created it.
Preserve the legal floor
CASL requires consent before sending commercial electronic messages to an electronic address, as explained in the Canadian Anti-Spam Legislation overview. It also requires sender identity and contact details, plus an unsubscribe mechanism that is actioned within 10 business days, according to CASL standards from the Canadian Marketing Association. A cleaning job can't repair missing consent provenance after the fact.
California workflows need comparable discipline. The CCPA and CPRA framework gives qualifying consumers access, deletion, and opt-out rights, and operational list cleaning can support deletion queues, suppression hygiene, and request tracking within the required 45 days, as described in the earlier California compliance source. Keep those records connected to the person and the systems that hold their data, not just to the last campaign.
Make re-engagement finite
Use a 60 to 90 day re-engagement window with three messages, each with a clear value proposition and a simple preference or unsubscribe path. After the final message, apply a sunset clause. Non-responders should move to a cold segment or archive rather than remain eligible for every general campaign.
Aggressive re-engagement can produce complaints when the offer misses the recipient's needs. Cap frequency, personalise subject lines, and exclude anyone with a complaint, hard bounce, or withdrawn consent. Canada's complaint environment makes this distinction especially important. The CRTC recorded 414,630 CASL complaints in 2024–2025, and only about 2.1 percent came through its online form, according to its CASL complaint reporting. A smaller active audience with documented consent is safer than a large audience that merely remains technically reachable.
Automate List Cleaning in Salesforce, HubSpot, and Account Engagement
A quarterly scrub fails because new records arrive every day and old records change status between audits. Automation should create a controlled pipeline that identifies exceptions, applies safe suppression rules, and leaves a traceable history for review.
Build the Salesforce control loop
A nightly Salesforce Flow can query Contacts modified since the last successful run. The flow can then:
- Normalise email and company-domain fields.
- Check duplicate keys against existing Contacts and Leads.
- Apply a regex-based syntax test.
- Route likely duplicates to a dedupe queue.
- Route invalid or suppressed records to a suppression campaign.
- Write validation status, job ID, timestamp, and error reason.
Don't make the flow overwrite records. Add fault paths, a retry policy, and an exception queue with an owner. Deploy changes through a sandbox and change set, then test merges, deletes, campaign membership, consent updates, and integration failures before production activation.
Mirror the logic in HubSpot
HubSpot Workflows can branch on hard-bounce and soft-bounce types, validation status, lifecycle stage, and suppression properties. A webhook can send eligible records to a validation vendor, then write the returned classification back to the contact. Keep the webhook idempotent so a retry doesn't create duplicate tasks or reverse a suppression.
Account Engagement needs special care around list refreshes. Use Automation Rules tied to a scheduled list refresh to identify invalid, stale, or unapproved prospects. Engagement Studio can then remove prospects whose score falls below the agreed threshold, but don't use engagement alone as proof that consent has expired. A low score may indicate timing or channel preference, not a legal withdrawal.
Scheduled jobs need monitoring. Capture success status, row counts, rejected records, API errors, and the last completed run. If a job fails, the sending process should fail closed for the affected segment rather than proceed with an unreviewed audience.
Teams documenting these patterns can use marketing automation best practices as a reference point, then adapt the controls to their object model, integration architecture, and approval process. MarTech Do supports this type of work through CRM configuration, data remediation, automation, integrations, and enablement across Salesforce and HubSpot environments.
Monitor Deliverability and Build Governance That Holds
Deliverability reporting should function as an operating dashboard, not a post-send autopsy. Track inbox placement, hard bounces, soft bounces, spam complaints, unsubscribes, and open-to-click ratio in Salesforce, Account Engagement, and HubSpot. Compare campaign results with seed-list testing through Glock or Inboxalerts, and use Google Postmaster Tools for available reputation signals.
Canada-specific data shows why inbox placement needs more nuance than a single list-size metric. Validity's 2025 benchmark reports 86.7 percent inbox, 5.4 percent spam, and 7.9 percent missing for Canada, meaning roughly one in seven messages isn't reaching the inbox even before downstream engagement is considered. The benchmark is available in Validity's 2025 report. Segment mailbox providers and complaint risk before deleting infrequent but valuable contacts.
Put governance beside the dashboard
A list-hygiene policy should define:
- Capture: Which forms, events, partners, and enrichment sources are approved.
- Consent: Where CASL and CCPA status, source, and timestamp live.
- Suppression: Which fields and events block sending across every platform.
- Review: Who approves exceptions, role addresses, catch-alls, and unknown results.
- Audit: When full audits run and how the team records decisions.
- Ownership: Who monitors scheduled jobs, vendor failures, and campaign readiness.
Also block scraped acquisition practices. Canadian privacy guidance notes that CASL covers electronic-address harvesting and collecting personal information through spyware, so list hygiene must reject improperly acquired addresses, not merely malformed ones, as described in CASL compliance help from the Office of the Privacy Commissioner of Canada.
| Metric | Healthy Threshold | Where to Measure | Governance Habit |
|---|---|---|---|
| Inbox placement | Above the campaign target | Seed tests and provider reports | Review before major sends |
| Hard bounce rate | Under the agreed campaign limit | ESP, Account Engagement, and HubSpot | Suppress and investigate source |
| Soft bounce rate | Stable relative to the segment | ESP and CRM campaign reports | Apply repeated-bounce rules |
| Spam complaint rate | Below the campaign limit | ESP and complaint feeds | Pause affected sends and inspect consent |
| Unsubscribe rate | Within historical tolerance | Marketing platform reporting | Review content, frequency, and audience |
| Open-to-click ratio | Monitored for drift | Salesforce, Account Engagement, or HubSpot | Compare engagement by segment |
Troubleshoot the first signal
A bounce spike usually points to stale imports, a recent acquisition file, a broken validation workflow, or a domain change. A complaint spike often points to missing opt-out synchronisation, weak consent capture, role addresses, or a shared Salesforce list reused across teams. Falling engagement can indicate sender reputation decay, excessive frequency, or a segment that should have entered re-engagement earlier.
The CRTC identifies the Spam Reporting Centre as the main reporting channel, and about 98 percent of submissions in one enforcement update were sent by email to spam@fightspam.gc.ca, as explained in its Spam Reporting Centre FAQ. Complaint handling therefore belongs in the same operational runbook as suppression, not in a separate legal folder.
A documented data governance framework gives analysts a place to record root cause, owner, corrective action, and prevention rule. That record is what turns one campaign incident into a durable improvement.
MarTech Do helps B2B teams audit and improve Salesforce, Account Engagement, HubSpot, integrations, automation, and revenue operations data, including deduplication, consent controls, and lifecycle governance. Visit MarTech Do to discuss a practical CRM and email list cleaning programme built around your systems, teams, and compliance requirements.
