When you import email list data into a new sending platform, you are making a first impression on every mailbox provider at once. The list you bring decides how that impression goes. A clean, well-documented list of people who expect your mail can start building reputation straight away. A mixed pile of old exports, event badges, purchased files and forgotten signups can damage a brand new domain in a week. This guide explains how to audit the consent behind your contacts, how to sort and validate them, how to send in stages and how to design a re-permission campaign. It is general information, not legal advice.
Why a list import is a risk event
A new sending platform, domain or IP address has no history. Mailbox providers watch what happens to your first messages and use that to decide how to treat the rest. If the opening mail goes to people who recognise you and want it, the signals are good. If it goes to addresses that bounce, to people who do not remember you or to spam trap addresses, the signals are bad and they are hard to reverse.
There is a legal side as well. Laws differ by country, but many of them look at whether the recipient agreed to receive marketing and whether you can show that. Our overview of US, Canadian and UK marketing email laws and our guide to GDPR consent, records and unsubscribes cover the main ideas. The practical point is that a list import is the moment when you are most likely to discover that your records are thinner than you thought.
Think of it this way: We are not only moving data. We are deciding which of these people we can honestly say asked to hear from us, and then proving it.
Audit consent evidence and source first
Before any file touches the new platform, group the contacts by how they arrived. Most lists are really several lists glued together over the years, and each part needs its own answer. For every group, ask the same questions.
- Where did these addresses come from? A signup form, a checkout, a trade show, a partner, a purchase, a scrape, a manual entry.
- What was the person told at the time? The exact wording next to the checkbox or form, and whether it named you and the kind of mail they would get.
- How did they agree? An active action such as ticking a box or confirming by email, or something weaker such as a pre-ticked box or silence.
- When did they agree? A date, not just a guess. Old consent that was never used is harder to rely on.
- Can we show it? A timestamp, a form version, a stored confirmation or a screenshot of the page. A memory is not evidence.
- Have they interacted since? A purchase, a click, a reply or a login tells us the relationship is alive.
Then give each group one of three verdicts. This is where honesty pays off, because the verdict decides what happens next.
| Verdict | What it looks like | What we do with it |
|---|---|---|
| Justified | Collected by us, with clear wording, a date and stored proof, and the person is reasonably recent | Candidate for import and segmentation |
| Uncertain | Collected by us, but the wording, date or proof is missing or the contact is old | Hold back and consider a re-permission campaign |
| Unjustifiable | Bought, rented, scraped, harvested from a website, copied from a partner without clear permission, or unknown origin | Do not use for marketing mail |
A signup process with double opt-in that records proof from day one makes this audit easy next time.
Why purchased, rented and scraped lists are a deliverability and legal risk
It is tempting to treat a large file as a shortcut, especially when it comes with a promise that the contacts are opted in. We advise against it, for reasons that stack up.
| Problem | Why it hurts |
|---|---|
| Recipients did not ask for your mail | They are more likely to mark it as spam or ignore it, and complaints are one of the strongest negative signals a mailbox provider sees |
| Spam traps and recycled addresses | Lists compiled by scraping or old harvesting can include addresses that exist only to catch senders who did not collect them properly |
| High bounce rates | Old, unverified data contains many dead mailboxes, and a pile of bounces at the start of a sender history looks careless |
| Shared reputation | A rented list is mailed by many senders, so the whole pool is tainted and you cannot control the quality |
| Legal exposure | Consent rules in many places focus on whether the individual agreed to hear from you. A seller saying the list is opted in does not give you proof of your own |
| Platform policy | Sending platforms commonly forbid these lists in their acceptable use rules, so you can lose your account. Check your MigoSMTP terms and policies for exact wording |
Scraped addresses deserve a special mention. Finding an address on a public web page does not mean the owner agreed to marketing mail, and in many jurisdictions it does not give you a legal basis to send it. Business-to-business rules differ by country, so take advice before relying on any exemption.
Segment by recency and engagement
After the consent audit, sort the justified and uncertain contacts by how recently they did something real. An open alone is an unreliable signal, because privacy features in some mail apps can register opens automatically. Prefer clicks, purchases, replies, logins and form submissions.
| Tier | Typical definition | Suggested treatment |
|---|---|---|
| A: recent | Real interaction in the last six months, with good consent evidence | Import first and send first |
| B: ageing | Last interaction six to twelve months ago | Import after A is healthy, send in careful waves |
| C: cooling | Last interaction twelve to twenty-four months ago | Re-permission before any normal marketing |
| D: dormant or unknown | Older than twenty-four months, or no activity data at all | Do not import into active sending; archive or delete according to advice |
The boundaries are examples, not rules. A business with an annual buying cycle may treat twelve months as recent, while a news site may treat three months as old. Choose thresholds that match how your customers actually behave, write them down and apply them consistently. Our list hygiene and sunset policy guide goes deeper on how to define and maintain these tiers.
Clean and validate before import
Do the cleaning on your side of the fence, before the platform sees the file. The order matters.
- Apply old suppressions first. Every unsubscribe, complaint and hard bounce recorded in the old system must carry over. Re-mailing someone who opted out is both a trust failure and a compliance problem.
- Remove duplicates and obvious junk. Normalise case, trim spaces and merge repeated rows, keeping the oldest consent record.
- Remove role addresses you did not collect for marketing. Shared mailboxes often generate complaints and were rarely given by a person who chose to subscribe.
- Validate what remains. Check syntax, domain and mail server records, and mailbox status where possible. Our guide to email validation before sending explains what each check can and cannot tell us.
Validation answers a different question from consent. It tells us whether a mailbox probably exists, not whether the person wants our mail. A perfectly valid address from a purchased list is still a risk.
Import with the evidence attached
When you load the file, carry the proof with each contact. If the platform supports custom fields, store them there. If it does not, keep a matching spreadsheet or database table under your control. Check your MigoSMTP account or API documentation for exactly how contacts and fields are handled. A simple, invented layout looks like this.
email,first_name,segment,consent_source,consent_date,consent_evidence_ref,last_interaction
alex@example.com,Alex,A,checkout_form_v3,2026-03-14,log-20260314-8812,2026-09-02
sam@example.org,Sam,B,newsletter_form_v2,2025-11-20,log-20251120-0455,2026-02-18
robin@example.net,Robin,C,webinar_signup_v1,2025-01-09,log-20250109-3310,2025-04-30Stage the first sends
Even a clean, justified list should not go out in one blast from a new sender. Start with the best contacts in small waves, and let each wave earn the next one. This is the same discipline we describe in our email warm-up guide.
- Choose a first message that people will recognise and want, such as a welcome back note with real value, not a hard promotion.
- Make sure the sending domain is authenticated and the unsubscribe link and header work before the first wave.
- Agree your pause thresholds in advance. Decide what bounce and complaint levels make you stop and investigate, and write them down before you are tempted to explain them away.
- Wait and look between waves. Check bounces, complaints, deferrals and delivery to major mailbox providers before releasing the next batch.
- Do not add the next tier until the previous one has been stable for a few sends.
Your sending platform may also apply its own limits and checks to new accounts and imports. Check your MigoSMTP account or API documentation for exact details rather than assuming.
Design a re-permission campaign
A re-permission campaign, also called a confirmation or reconfirmation campaign, asks contacts you can justify but are unsure about to say that they still want your mail. It is for the middle of the list. It is not a way to launder an unjustifiable list, and it is not for people who already unsubscribed.
Principles
- Ask honestly. Say who you are, why you are writing and what the person will get if they say yes. Do not hide the question in a promotion.
- Require a clear action. A click on a confirmation button or a reply is a signal. Silence is not. Do not treat no response as yes.
- Make no the easy answer. Include a working unsubscribe link and header, and honour it immediately.
- Record the answer. Store the time and the exact wording that was shown with the confirmation.
- Keep it short. One subject, one question, one button.
Sequence
- Send the first request to a small test wave and read the results before the rest.
- Send the main wave. The subject should name the question, for example, do you still want to hear from us.
- Send one or two short reminders to people who have not responded, spaced out over a fixed period. Stop after that.
- At the end of the window, move everyone who did not confirm out of your sending segments.
What to expect, and what not to promise yourself
Expect a large drop-off. That is not a failure of the campaign, it is the campaign working: it separates people who still want your mail from people whose addresses are abandoned, who forgot you or who are not interested. We cannot give you a response figure, because it depends on how old the contacts are, how they originally joined, how well known the brand is and what you offer. Run a small test wave, measure your own result and plan the business case around the smaller list. A smaller list of people who confirmed is usually a better asset than a large list of people who did not.
Be careful with the message itself. A confirmation request sent to contacts who have no valid basis for being mailed can itself be an unwanted marketing message in some places, so base the re-permission group on contacts you can justify, not on whole unknown files. Ask a qualified adviser if you are unsure.
What to do with data you cannot justify
Some part of nearly every old list falls in the unjustifiable group. Resist the urge to import it just in case.
- Do not mail it for marketing. That includes a re-permission email, unless your adviser confirms a lawful basis for contacting that group.
- Keep it out of the active platform. Do not load it into the new account, even as a disabled segment.
- Decide retention with advice. Depending on where you and the contacts are, you may need to delete the data or have a reason to keep it. Where the person has opted out, keep the minimum needed to honour that, which is normally the address itself on a suppression list.
- Replace it the right way. Rebuild reach through forms, checkout opt-ins, content and partnerships that collect clear consent with proof.
Keep records that prove what you did
If a recipient complains, a mailbox provider asks questions or a regulator writes, you will want to answer quickly and with documents. Build a small file at the time of the import, not months later.
| Record | What to keep |
|---|---|
| Source inventory | Each list segment, where it came from, the dates it was collected and who handled it |
| Consent wording | The form text and version shown at signup, with screenshots where possible |
| Per-contact proof | Timestamp, source, and a reference to the stored log or confirmation |
| Audit decisions | Which groups were rated justified, uncertain or unjustifiable, and why |
| Cleaning log | Counts removed by suppression, duplicates, role addresses and validation |
| Re-permission results | Wave sizes, dates, confirmations, opt-outs and non-responders |
| Suppression list | Everyone who opted out, bounced or complained, kept permanently so they are never re-imported by accident |
A worked example
A small online retailer is moving 50,000 contacts from an old tool to a new sending platform. The numbers below are invented to show the process, not to predict your results.
First the audit. The retailer finds that 6,500 contacts came from a file bought years ago by a previous owner, with no proof of consent. Those are marked unjustifiable and set aside. That leaves 43,500. Using last real interaction (purchase, click or reply), the retailer sorts the remainder into tiers.
| Tier | Contacts | After cleaning and validation | Plan |
|---|---|---|---|
| A: last 6 months | 8,000 | 7,900 | Import and send first |
| B: 6 to 12 months | 10,500 | 10,300 | Import and send after A is healthy |
| C: 12 to 24 months | 11,000 | 10,700 | Re-permission campaign |
| D: older or unknown | 14,000 | not processed | Not imported; archive pending advice |
| Unjustifiable source | 6,500 | not processed | Not imported; handled with advice |
Cleaning removed 100 addresses from A, 200 from B and 300 from C, for a total of 600, through suppressions carried over from the old tool, duplicates and failed validation. That leaves 28,900 contacts ready to be used.
Tier A goes out in three waves of 1,000, 2,000 and 4,900 contacts, which adds up to 7,900. The team checks bounces, complaints and delivery after each wave before starting the next. Tier B follows later in waves of 2,500, 3,000 and 4,800, which adds up to 10,300, again with pauses between them.
For tier C, the retailer sends a confirmation request to 10,700 contacts. In this example, 1,600 click to confirm, 150 unsubscribe and 8,950 do not respond, which adds up to 10,700. The 1,600 who confirmed join the active list with the confirmation time stored. The 150 are added to the suppression list. The 8,950 non-responders are moved out of sending segments after the reminder window.
| Outcome | Contacts |
|---|---|
| Started with | 50,000 |
| Active after A, B and confirmed C | 19,800 (7,900 + 10,300 + 1,600) |
| Suppressed after opting out | 150 |
| Not mailed: no response, dormant, or unjustifiable | 8,950 + 14,000 + 6,500 |
The retailer ends up mailing well under half of the file it started with. That list is made up of people who bought or clicked recently, or who said yes when asked. It is a far safer start for a new domain than 50,000 mixed contacts would have been.
An import checklist
- Export the full list with every field, date and status from the old system.
- Group contacts by source and rate each group justified, uncertain or unjustifiable.
- Set aside anything bought, rented, scraped or of unknown origin.
- Segment the rest by last real interaction into recent, ageing, cooling and dormant tiers.
- Carry over every unsubscribe, complaint and bounce, then remove duplicates and role addresses.
- Validate remaining addresses and import with source, date and evidence reference attached.
- Authenticate the sending domain, then send in small waves starting with the most recent tier, with agreed pause thresholds.
- Run a re-permission campaign for the cooling tier, treat silence as no, and write down everything you did.
Planning a list migration? Tell us the size and age of your list, how it was collected and where you are moving from, and we will help you plan a safe staged import.
Further reading and sources
Frequently asked questions
Can I import any list I already own into a new platform?
Owning a file is not the same as having permission to send marketing email to everyone in it. What matters is how each address was collected, what the person was told and whether you can show it. A list built from your own signup forms, orders or in-person requests with clear wording is a very different thing from a file you bought or copied. Audit the source of each group before you import it.
Why are purchased, rented and scraped lists such a problem?
The recipients never asked to hear from you, so complaint rates tend to be high and the list often contains spam trap addresses and dead mailboxes. Mailbox providers measure how recipients react, and a sender whose first messages are mostly unwanted gets filtered. There is also legal exposure in many places, because consent rules such as GDPR and PECR in the UK generally look at whether the person agreed to receive your messages. Consult a qualified adviser for your situation.
Is a re-permission campaign always required?
No. If you hold good evidence of consent for a group, and the contacts are recent and engaged, you may not need to ask again. Re-permission is most useful for contacts you can justify but have not heard from in a long time, or where your records are incomplete. It is a tool for the middle of the list, not a ritual for everyone.
What response rate should I expect from a confirmation email?
It varies widely with list age, how the contacts joined, the brand relationship and the offer in the message, so we do not quote a figure. Plan on a large share of contacts not responding, because many old addresses are abandoned and many people simply ignore the message. Measure your own result on a small test wave first and treat silence as no permission.
Should I email the people who do not respond to the confirmation request?
Not with marketing messages. If someone never confirmed, you have not refreshed the permission you were unsure about. A common approach is a short reminder or two over a limited period, then moving non-responders out of your sending segments. Whether you keep their data at all depends on your legal basis and retention rules, so take advice on that.
Do I need to validate addresses if the list is my own?
Yes. Even a well-collected list decays as people change jobs and abandon mailboxes. Checking syntax, domain records and mailbox status before the first send removes addresses that would bounce, which protects your new reputation. Validation does not create permission, and it does not replace the consent audit.
How big should my first send be?
Small enough that a surprise would not hurt you. Begin with the most recent, most engaged contacts in modest batches, look at bounces, complaints and delivery before each next batch, and grow only while the numbers stay healthy. Your sending platform and warm-up approach may also set limits, so check your MigoSMTP account or API documentation for exact details.
What records should I keep?
For each contact or group, keep the source, the date, the wording or form version they saw, how consent was given and where the proof is stored. Also keep a log of your audit decisions, the re-permission campaign results and the list of contacts you suppressed or removed. These records let you answer a complaint or a regulator question quickly.
What if I cannot tell where part of my list came from?
Treat it as unjustified for marketing mail. Do not import it into your active sending segments. Keep it separate and decide with a qualified adviser whether it should be deleted. Building a fresh, properly consented list is usually safer than gambling the reputation of your new domain on it.