What to Actually Do With Risky and Unknown Verification Results

Run a list and you get four statuses back. Two of them decide themselves: deliverable stays, undeliverable goes. Nobody agonises over those.

The other two are where people get stuck, and where the wrong default costs real money in both directions. Risky and unknown are addresses where the evidence did not resolve, and the honest answer to "what should I do with them" is that it depends on something the verification result cannot know: how much risk your sender reputation can currently absorb.

Here is how to make that call properly.

01What each status actually means

They are not synonyms, and the distinction matters for what you do next.

Risky means we reached a conclusion but the conclusion carries a caveat. The most common cause is a catch-all domain: the server accepted our check, but it accepts checks for every address at that domain, so acceptance carries no information about this specific mailbox. Role-based addresses like info@ or sales@ also land here, because they exist but belong to a shared inbox rather than a person.

Unknown means we could not reach a conclusion. The recipient server refused the conversation, timed out, or responded in a way that told us about its policy rather than about the mailbox. Some providers decline checks from everyone as a matter of course.

The practical difference: a risky address is probably real but ambiguous. An unknown address might be anything, and the reason we do not know is usually about the server rather than the address.

We keep these separate rather than merging them into a single score because the right action genuinely differs, and because collapsing them would hide the reason.

02The question that decides it

Not "is this address good." You cannot know that. The question is: what does a bounce cost me right now?

That is a question about your sender reputation, not about the address, and it has three plausible answers.

Reputation is fragile. You have been blocklisted recently, your spam complaint rate is near the ceiling, you are warming a new domain, or your last campaign underperformed on placement. In this state a bounce is expensive because you have no margin.

Reputation is healthy with headroom. Complaint rate well under 0.10%, bounce rate low, placement good. A modest increase in bounces is absorbable.

You are running outbound where bounces are expected. Cold B2B prospecting on an isolated subdomain, where a higher bounce rate is priced into the channel.

Those three states produce three different correct answers to the same verification result. Which is why no tool can decide this for you, and why anyone offering a single recommended action is guessing about your circumstances.

03Recommendations by state

If your reputation is fragile: exclude both

Send only to deliverable. Do not touch risky or unknown until placement recovers.

The reasoning is asymmetric cost. The upside of mailing an ambiguous address is one possible reader. The downside, when you have no reputation margin, is compounding damage on the audience you can already reach. Under the current bulk sender requirements, Gmail's hard ceiling of 0.30% on spam complaints allows only 150 complaints per 50,000 messages, and a sender already near that line should not be adding uncertainty of any kind.

Set them aside. They are not lost, just deferred.

If your reputation is healthy: send to risky, hold unknown

This is where most established senders sit, and the split is worth the extra step.

Risky addresses are usually real. Catch-all domains are common among legitimate small businesses and agencies, and excluding all of them means deleting genuine customers on a technicality. If you have headroom, mail them and let the bounce data tell you which domains are worth keeping.

Unknown is a weaker position. The server would not tell us anything, so you are sending blind. Hold these unless you have a specific reason to want them.

One refinement worth doing: risky addresses cluster by domain, so look at the domain rather than the address. If forty addresses come back risky and they are all at the same catch-all domain, that is one decision about one company, not forty decisions. Often you know whether that company is a real customer.

If you are running cold outbound: send to both, on isolated infrastructure

Cold outbound already accepts a higher bounce rate as a cost of the channel. Excluding every ambiguous address on a prospecting list removes a large share of your addressable market, because business domains are disproportionately catch-all.

The condition is genuine isolation. Separate subdomain, separate sending infrastructure, so the elevated bounce rate does not contaminate the reputation of your marketing domain. If you are sending cold outbound from the same domain as your newsletter, fix that before worrying about which statuses to include.

04The tranche approach, when you are unsure

If you cannot confidently place yourself in one of the three states, do not guess. Measure.

Take the risky segment, send to a small slice of it, and read the result before deciding about the rest.

Send 500. Wait for the bounce data. If the bounce rate on that tranche comes back under 3%, the segment is mostly real and you can proceed. If it comes back at 15%, you have learned something specific about your list for the cost of 500 messages, and you can exclude the rest with confidence.

This is strictly better than deciding in the abstract, because it replaces a judgment about a category with a measurement of your actual data. Our re-engagement guide uses the same tranche mechanic for the same reason.

05Things people do that do not work

Treating risky as undeliverable and deleting it. The most common mistake and a genuine loss. You are deleting real customers because their employer runs a catch-all mail server, which is a configuration choice they made and have no idea affects them.

Treating unknown as deliverable and mailing it. The opposite mistake. Unknown means the server told you nothing. Reading that as permission is not supported by anything.

Re-verifying repeatedly hoping for a different answer. A catch-all domain will be catch-all next week too. That is a permanent property of the domain's configuration, not a transient condition. Re-running costs credits and returns the same verdict.

The one exception: unknown caused by a timeout or a temporary refusal genuinely can resolve differently later, because the cause was the server's state at that moment. Re-checking unknown after a few days is sometimes worthwhile. Re-checking risky is not.

Averaging the four statuses into one health score. Some tools do this and it destroys the information. A list that is 80% deliverable and 20% undeliverable needs a completely different action from one that is 80% deliverable and 20% risky, and a single score cannot distinguish them.

06Why we report uncertainty at all

Worth saying plainly, because reporting uncertainty makes our published accuracy figure look worse than it needs to.

We could mark every catch-all address deliverable. Our decision rate would go to nearly 100%, our accuracy number would go up, because guessing on a catch-all is right more often than not, and you would send to addresses we have no evidence about while believing you had evidence.

We would rather tell you we do not know. It is less satisfying to pay for, and it means you can make a decision that fits your actual situation instead of inheriting ours.

The trade-off is that you have to do the thinking in this post. That is a real cost and I would rather it sat with you, holding the information, than with us, guessing on your behalf.

07The short version

Risky is probably real but ambiguous, usually a catch-all domain. Unknown means the server told us nothing.

If your reputation is fragile, send to neither. If it is healthy, send to risky and hold unknown. If you are running isolated cold outbound, send to both. If you are unsure, send 500 and measure rather than deciding in the abstract.

Do not delete risky as though it were undeliverable, and do not mail unknown as though it were deliverable. Group risky addresses by domain before deciding, because it is usually one decision about one company rather than many decisions about many addresses.

See the four-status split on your own list. 500 free credits a month on the full deep scan.