A bounce rate of 6% sounds harmless. Ninety-four percent of your emails were delivered, after all. But mailbox providers read it differently: roughly one in sixteen messages went to an address you had no business sending to. That is the signature of a purchased or stale list, and it is one of the fastest ways to lose inbox placement across an entire domain.
Bounces are the most preventable deliverability problem in cold outreach. Unlike spam complaints, which depend on how recipients feel about your message, bounces depend entirely on your data. You control them before you press send.
This playbook covers what actually causes bounces, the thresholds to enforce, a verification workflow that holds up at volume, and how to monitor bounces once campaigns are live.
Receiving servers treat a bounce as evidence about your sending practices. A single failed delivery means nothing. A pattern means you are guessing at addresses or working from old data, and both are behaviors spammers share.
There are two types, and they carry different weight:
- Hard bounces are permanent failures: the mailbox doesn't exist, the domain doesn't exist, or the server rejects you outright. These are the damaging ones. Every hard bounce tells the provider you didn't validate your list. - Soft bounces are temporary: full mailbox, server timeout, message too large, or a greylisting delay. These are usually harmless in isolation, but repeated soft bounces to the same address should be treated as hard failures after two or three attempts.
A third category deserves attention: blocks. When a provider rejects your message with a reputation-related code (for example, citing your IP or domain), that isn't a bad address. It's a symptom that you have already been flagged. If you see blocks climbing, stop and work through the steps in our guide to recovering a burned cold email domain.
The practical thresholds most senior operators work to:
| Metric | Target | Pause and investigate | |---|---|---| | Hard bounce rate (per domain, rolling 7 days) | Under 1% | Above 2% | | Total bounce rate (per campaign) | Under 2% | Above 3% | | Single-day hard bounces on one mailbox | 0 to 1 | 3 or more |
For context on the downstream effect, Google's bulk sender requirements already put a hard ceiling of 0.3% on spam complaint rates, and sending to invalid addresses is correlated with the same low-quality sending patterns that drive complaints. Keeping bounces low is the cheapest way to stay well clear of both.
Fixing bounces starts with knowing the source. Almost every bad address traces to one of five causes:
1. Stale data. B2B contact data decays quickly. People change jobs, companies rebrand, domains get retired. A list that was 95% accurate a year ago may be 80% accurate now, and a meaningful slice of the loss lands on high-seniority titles, who change roles and get replaced in the same data. 2. Guessed patterns. Many tools infer addresses from a pattern (first.last@company.com). When the pattern is wrong, you get a hard bounce. When the company uses a catch-all, you get a false positive that isn't real. 3. Catch-all domains. These servers accept every message regardless of whether the mailbox exists. They look deliverable during verification and then silently discard or bounce later. 4. Role accounts. Addresses like info@, sales@, and admin@ rarely reach a decision-maker, generate complaints, and sometimes route to spam-trap-adjacent systems. 5. Typos and scraping artifacts. Extra characters, truncated domains, and addresses lifted from formatted text.
Each cause calls for a different control, which is why a single verification pass isn't enough.
The workflow below is what we recommend for any team running cold email automation at more than a few hundred sends per day. Each stage removes a different class of risk.
Cheap and instant. Validate format, confirm the domain has MX records, and drop disposable-domain addresses. This catches typos and dead domains before you spend anything on deeper checks. Expect to remove 1% to 3% of a scraped list here.
Use an SMTP-based verification service to ask the receiving server whether the specific mailbox exists, without sending a message. Classify each result into one of four buckets: valid, invalid, risky (catch-all or unknown), and unverifiable. Keep valid, discard invalid, and route the rest through Stage 3.
Two cautions. First, verification vendors disagree, particularly on catch-all domains, so treat any "valid" as probabilistic. Second, verification results expire. An address verified 90 days ago needs to be rechecked before you send. Build the timestamp into your data model and re-verify anything older than 30 days before it enters a sequence.
Catch-all domains are common in B2B, especially at smaller companies, so you can't simply drop them without gutting your addressable market. Instead:
- Cap them at a small share of any campaign (10% to 15% is a reasonable ceiling). - Send them from your most established mailboxes, not new ones. - Prefer addresses that have corroborating evidence, such as the same pattern confirmed valid for other employees at that company. - Track their bounce performance as a separate segment so a bad batch doesn't hide inside your overall average.
Remove generic role addresses, competitors, existing customers, and anyone on your suppression list. This is also where you apply your compliance rules, covered in our cold email compliance guide.
After these four stages, a list that began at 10,000 contacts typically lands somewhere between 7,500 and 8,500 sendable addresses. That 15% to 25% reduction feels expensive until you compare it with the cost of replacing a burned domain.
The weakness in most teams' process is that verification sits after list building as a separate task someone remembers to do. Lists get exported, edited by hand, merged, and sent without a recheck.
A better design treats verification as a gate that every contact must pass before it can enter a sequence, with no manual bypass. That's how our platform handles it: automated prospecting collects and enriches leads, scores them against your ideal customer profile, and only verified, in-date contacts are eligible for outreach. Because the gate is structural, a rushed Friday upload can't push 2,000 unchecked addresses into a live campaign.
If you're building your own process, the principle still applies. Whatever tooling you use, make unverified contacts physically unable to reach the sending queue. For the upstream half of this problem, see our guide to building verified B2B contact lists.
This also matters for teams moving away from manual prospecting. One of the quiet advantages of a well-run SDR replacement model is consistency. A human SDR under quota pressure will sometimes skip the verification step to hit activity numbers. A system won't.
Verification lowers risk. It doesn't remove it, because addresses can go bad between check and send. Set up monitoring that reacts faster than you would manually.
Automatic suppression. Any hard bounce should immediately and permanently suppress that address across all campaigns and all mailboxes. Sending to a known-bad address a second time is a self-inflicted wound.
Per-mailbox thresholds. Track bounces at the mailbox level, not just the campaign level. If one mailbox hits three hard bounces in a day, pause it and review the batch it was sending. A problem in one segment can otherwise be diluted by healthy mailboxes elsewhere.
Bounce-code reading. Don't treat all failures alike. Codes beginning 5.1.1 indicate a nonexistent mailbox (a list problem). Codes referencing policy, reputation, or blocklists (often 5.7.x) indicate a sender problem. Mixing them hides the real cause.
Weekly review. Look at bounce rate by lead source, by industry, and by data age. You'll usually find that one source accounts for most of the failures. Cut or fix that source rather than tightening thresholds across the board.
The full monitoring setup, including alert thresholds and escalation, is laid out in our deliverability audit framework. If you're newer to sender infrastructure, make sure authentication is correct first with the SPF, DKIM, and DMARC setup guide, because authentication problems can produce bounce-like rejections that no amount of list cleaning will fix.
Consider an illustrative scenario with round numbers. A team sends 300 emails per day across six mailboxes, drawing from a purchased list of 12,000 contacts with no verification. Their bounce rate runs at 7%, which is 21 hard bounces a day, or about 3.5 per mailbox.
They add the four-stage workflow. Syntax and domain checks remove 2%. SMTP verification removes another 12% of invalid addresses and flags 18% as risky. Role-account stripping removes 3%. They cap risky addresses at 12% of daily volume and send only to the verified remainder otherwise.
The expected result is a bounce rate in the 1% to 1.5% range: three or four bounces a day across the whole program instead of twenty-one. The list shrinks by roughly a fifth, but the same sending capacity now reaches real inboxes, and the domains stay healthy enough to scale. Your own numbers will differ, but the shape of the improvement is reliable: the earlier the filter, the cheaper the fix.
- Verifying once and sending for months. Treat verification as perishable. - Trusting "valid" on catch-alls. It means "accepted," not "read." - Ignoring soft bounces. Persistent soft bounces are often hard failures in disguise. - Raising volume to compensate for list shrinkage. This just moves the problem to complaint rates. - Cleaning the list but not the source. If one data provider drives most of your bounces, replace it.
Bounce rate is the one deliverability metric you can almost entirely control. Set clear thresholds, verify in stages, handle catch-alls deliberately, suppress hard bounces instantly, and review bounce data by source every week. Do that, and the inbox placement problems that sink most cold email programs mostly never appear.
If you'd rather not build and police this process by hand, OnyxSend bakes verification, suppression, and per-mailbox monitoring into the sending pipeline, so every contact is checked before it can be contacted. You can see how it fits your volume on our pricing page and start with a small, clean campaign to measure the difference in your own bounce numbers.