A business leads list is a file of companies and named contacts assembled for sales or marketing outreach, sold by brokers, compilers, marketplaces and database vendors. A clean one has a verification date on every row, under 5% invalid addresses, under 3% role mailboxes and a documented source per record. In the BounceZero corpus of 7.93 million verified addresses, the average uploaded business list was 14.5% invalid and 27% unconfirmable; clean lists are the exception, not the norm.
Before looking at any seller, fix the standard. These are the fields and numbers a list should carry to be worth money.
Unique person count equals row count, within 1%. An ID per row so bounces can be reported back for replacement.
A date column and a method column (SMTP check, observed send, pattern inference). Median age under 90 days.
Valid, catch-all, unknown already flagged by the seller, or at least a catch-all count. A seller who reports 100% deliverable has not checked.
Observed or inferred, and where from. Inferred addresses bounce two to three times more than observed ones.
Title, company, company size, industry, country. Below that the list cannot be segmented and is priced as raw contacts.
info@ and sales@ under 3%; gmail.com and similar under 5% in a business file. Both are padding when higher.
Price ranges are vendor-reported for 2026. The verified column is what independent verification of delivered files typically shows before cleaning.
| Seller type | Typical offer | Price per record (vendor-reported) | Invalid on delivery | When it makes sense |
|---|---|---|---|---|
| Subscription database export | Filtered export from a live platform | $0.10 to $1.00 effective | 10 to 22% | Repeat prospecting; you want filters more than files |
| Specialist broker | Compiled file for a defined segment | $0.15 to $0.60 | 12 to 30% | Niche verticals; one-off campaigns |
| Trade and registry compiler | Registry data joined to contacts | $0.05 to $0.30 | 15 to 35% | Regulated industries, local markets |
| Marketplace CSV seller | Category file, instant download | $0.01 to $0.10 | 25 to 45% | Experiments only, after a sample test |
| Lead generation agency | Built list plus outreach as a service | Bundled; $1,500 to $10,000 a month | 5 to 15% if they verify | When you want the campaign run, not just the data |
Agencies are covered separately in cold email lead generation agencies. Database vendors in B2B email list providers.
Most dirty lists are not fraud. They are old. A file compiled two years ago from legitimate sources has lost roughly 22% of its mailboxes a year to job changes and company closures, so it is 40% gone before anyone opens it. The seller's "verified" claim was true at compile time.
The second source of dirt is pattern inference. When a compiler knows a company's address format and the names of its staff, it generates every address. These rows look identical to observed ones and bounce far more often, especially at companies that changed format or use nicknames.
The third is catch-all domains. A catch-all server accepts any local part, so every guess "verifies". In the corpus 2.3% of non-freemail (business and ISP) addresses sit on catch-all domains overall, and 12.4% of .org addresses do. A list heavy in non-profits or universities carries more unconfirmable rows than its seller realises.
The fourth is resale. Marketplace files are sold to many buyers over years. Everyone who bought it before you has mailed it, so the addresses that remain have seen the same pitches and the domains have been reported.
Take 200 random rows, run them through verification, and read the result against these cut-offs. The whole thing fits inside the free tier.
| Check | Clean | Needs work | Dirty |
|---|---|---|---|
| Invalid | Under 5% | 5 to 10% | Over 10% |
| Catch-all | Under 4% | 4 to 8% | Over 8% |
| Unknown (excluding German ISPs) | Under 6% | 6 to 12% | Over 12% |
| Role addresses | Under 3% | 3 to 8% | Over 8% |
| Freemail in a business file | Under 5% | 5 to 15% | Over 15% |
| Duplicate people | Under 1% | 1 to 3% | Over 3% |
| Disposable or spam-trap hits | None | One | Two or more |
Corpus averages for comparison: non-freemail (business and ISP) domains 14.5% invalid, 2.3% catch-all, 27% unknown. A list that merely matches the average is a "needs work" list. Source: benchmarks 2026.
The providers in a file are a fingerprint. Legacy ISP mailboxes mean an old compile; these are corpus results for the providers that signal age most strongly.
| Provider | Signal | Verified | Invalid | Unknown | Confirmed valid |
|---|---|---|---|---|---|
| gmail.com | Current | 801,225 | 3.5% | 0.0% | 96.0% |
| hotmail.com | Mixed | 253,445 | 16.5% | 0.0% | 70.5% |
| aol.com | Old compile | 33,275 | 17.9% | 19.9% | 11.0% |
| sbcglobal.net | Old compile | 232,302 | 4.6% | 36.3% | 18.0% |
| bellsouth.net | Old compile | 134,384 | 4.6% | 43.7% | 15.5% |
| telefonica.net | Old compile | 159,794 | 42.8% | 8.0% | 48.5% |
A business list with more than a few percent of sbcglobal.net, bellsouth.net or aol.com rows was compiled from sources that stopped updating years ago.
Title, seniority, company size, industry, country. A seller who cannot filter to it is selling you a bigger file than you need.
The six items in the first section. The answers tell you whether to continue.
Your random seed, not theirs. Verify and compare.
Over 10% invalid in the sample is leverage for a discount, a replacement clause, or a walk.
Bulk verification to a million rows per job. Keep the seller's row ID for bounce claims.
Catch-all and unknown go to a warm, low-volume track. Invalid goes back to the seller. Volume doubles weekly while bounces stay under 2%.
In the UK, PECR lets you email corporate subscribers without prior consent as long as you identify yourself and offer an opt-out, and UK GDPR requires a documented legitimate interest plus a privacy notice naming the data source. Sole traders are individuals and need consent. The EU varies by state; Germany is strict. The US permits unsolicited B2B email under CAN-SPAM with identification, a postal address and a ten-day opt-out. The seller should be able to state the lawful basis for every record; if they cannot, the list is a liability regardless of how clean it verifies. The GDPR guide covers notices and retention.
Vendor types compared with the pre-purchase checklist
The 12-point check and bounce data by country
The buying guide with verification built in
Rescuing a list you already own
The corpus tables in full
Sources ranked by data quality
From subscription databases as filtered exports, from specialist brokers who compile to your segment, from registry and trade compilers, from marketplace CSV sellers, or bundled with outreach from a lead generation agency. Price and freshness rise together; marketplace files are cheapest and oldest.
A stable ID, name, title, company, company size, industry, country, a work email with a verification date and method, a catch-all or unknown flag, the source of the address, and a phone where available. Field fill rates above 85% and under 5% invalid addresses on a verified sample.
Verify 200 random rows. Over 10% invalid means old. A high share of aol.com, sbcglobal.net or bellsouth.net addresses in a business file means it was compiled years ago. A seller that cannot give a verification date per row or a source per record is selling recycled data.
Buying is legal everywhere. Emailing depends on jurisdiction: corporate addresses in the UK can be contacted under PECR with an opt-out and a documented legitimate interest, the US allows it under CAN-SPAM, and several EU states require consent. The seller must be able to state the lawful basis for collection.
Vendor-reported 2026 ranges: a cent to ten cents per record on marketplaces, fifteen to sixty cents from brokers, and ten cents to a dollar effective from database exports. Price it on confirmed valid addresses, not rows: a $0.30 record that is 85% valid costs less per usable contact than a $0.05 record that is 55% valid.
Upload 200 rows, get the clean-or-dirty answer with valid, invalid, catch-all and unknown per row. 100 free checks a month, unknowns refunded.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Where lists come from, what bounces, and what to check before you pay
Buy leads for real estate in 2026
Evaluating a B2B database for sale? Compare subscription databases and one-off files on coverage, accuracy...
Real estate email address lists in 2026
Buying an email list for lead generation in 2026
A B2B leads database is only as good as the share of its contacts you can still reach
Seven B2B contact database providers compared on coverage by region, email accuracy at export, refresh...
Continue through related topics