Gate the job before upload

Require an authenticated account, current plan/permission, explicit statement that the user is authorized to process the addresses, accepted-use limits, and step-up confirmation for unusually large work. Technical verification is not permission to market to a list, and a purchased list should not become acceptable because addresses appear reachable.

Estimate rows, provider calls, worst-case DNS/SMTP work, completion time, and cost. Reject jobs that exceed reviewed limits rather than starting an operation that cannot finish safely.

Treat the file as hostile

Allow one documented format such as UTF-8 CSV with a required header. Bound compressed and uncompressed size, row count, column count, field length, and parser time. Store outside public paths with a generated name. Reject executable content, formulas when exporting to spreadsheets, archives, and malformed encodings according to the supported contract.

Parse in a queue and record per-row validation without loading the entire file into memory. Deduplicate under an explicit address-comparison policy while preserving a mapping to authorized source rows.

Design partial results

Every row needs a state: pending, syntax-invalid, routing-observed, ambiguous, temporary, unavailable, completed, or cancelled. Provider outage must not convert the rest of the file to “valid.” Retry only temporary work with bounded attempts and domain/provider circuit breakers.

Expose aggregate progress and safe errors; do not stream addresses into logs. Support pause/cancel and stop undispatched work promptly. Use idempotency so a browser retry does not duplicate a paid or network-heavy job.

Export safely

Authorize every download, use expiring server-generated files, set no-store/private headers, and protect spreadsheet consumers from formula injection. Include observation time, method/source, and limitations with each result. Separate verification from marketing-consent fields so downstream teams cannot confuse them.

Delete on a schedule

Define expiry for uploads, normalized addresses, row results, exports, caches, and provider copies. Test deletion and document backup propagation. Retain only minimal audit facts needed for authorization, cost, and abuse investigation.

Launch after load, quota, outage, cancellation, cross-tenant access, and deletion tests. A safe bulk workflow finishes within declared limits and can say “unknown” at scale; it never manufactures certainty to make a completion percentage look better.