The direct answer: export → dedupe → verify → suppress → re-engage slowly → keep an audit trail. An old CRM is different from a fresh signup list — the addresses were valid once, but time has rotted a large share of them, and the danger isn't just wasted sends, it's that firing a campaign at a stale list produces a bounce and complaint spike that can get your sending domain throttled or blacklisted. Every step below is designed to remove the rot before you send anything, and to ramp the first send so gently that even a few surviving bad addresses can't hurt you.
1. Export a working copy — never clean in place
Pull the contacts out of your CRM as a CSV, including the fields you segment on and, crucially, any existing bounce, unsubscribe and last-activity data. You clean the export and sync back a result, so a mistake never touches the live system. Confirm the file is well-formed first — a shifted column or wrong delimiter corrupts everything downstream. The mechanics of exporting and validating a file are covered in the general list-cleaning workflow; this guide focuses on what's different about a CRM: duplicates from years of imports, contacts with rich history, and the need for an audit trail.
2. Deduplicate — and merge history, don't just delete
CRMs accumulate duplicates like nothing else: the same person imported three times from three sources, Jane@Example.com and jane@example.com as separate records, a lead and a contact for one human. Normalise the domain to lower-case and trim whitespace before comparing, or you'll keep copies you meant to merge. The CRM-specific twist: merging matters more than deleting. Each duplicate may hold different history — one has the deal, another has the support tickets. Merge records so you keep the richest history under a single canonical address, rather than blindly deleting the "extra" one and losing data. Dedupe before verifying, always, so you never pay to check the same address twice.
3. Bulk-verify what survives
This is the core of a CRM cleanup, because the whole point is that these addresses have aged. Verification confirms which mailboxes still exist without sending anything — it checks syntax, looks up MX records, and probes the mailbox over SMTP. For a whole database, upload the deduped CSV for bulk verification rather than looping single checks. Before you commit to cleaning the entire file, run a sample through the Email List Health Report to see how bad the rot is — a CRM that's two years untouched might be 30–40% invalid or risky, and that number tells you how careful the re-engagement in step 5 needs to be. Then verify the full list, and map each result to an action using the results-explained guide: deliverable to keep, undeliverable to suppress, risky/catch-all/unknown to segment. Spot-check individual oddities with the Email Verifier.
4. Build a permanent suppression list
Everything you remove — confirmed undeliverable addresses, old hard bounces, past unsubscribes, and spam complaints — goes onto a permanent suppression list, not into the trash. This is the step people skip, and skipping it undoes the whole exercise: without suppression, the next CRM sync or import re-adds the dead addresses and you re-mail them straight into another bounce spike. Suppression must be a one-way door. Store the suppressed address plus the reason and date (that feeds the audit trail in step 6), and configure your CRM and ESP so a suppressed address can never be re-activated by an import. Never delete unsubscribes outright — you need the record to prove you honoured the opt-out.
5. Re-engage carefully — ramp, don't blast
Here is where CRM cleanups go wrong even after good verification. These contacts haven't heard from you in a long time, so even the verified-deliverable ones will show lower engagement and higher complaint rates than a warm list — and if you email all of them at once, mailbox providers read the sudden volume from a cold sender as spam. So ramp the re-engagement send: start with the most recently active, verified-deliverable contacts, send in small batches, and watch bounces, complaints and opens before widening. If the early batches look clean, expand; if complaints climb, stop and reassess. Keep the risky/catch-all/unknown segment out of this first ramp entirely — let the clean core rebuild your reputation before you touch the uncertain addresses. A gentle re-engagement to a verified subset is the difference between reviving a list and burning your domain.
6. Keep an audit trail
Log every change: what was merged, what was suppressed and why, when each address was verified and the result, and who ran the cleanup. This isn't bureaucracy — it's what lets you prove consent and honour opt-outs (relevant to data-protection obligations), diagnose a later deliverability problem, and avoid re-cleaning the same records next quarter. A CRM is a shared system of record, so the trail also stops a teammate from "helpfully" re-importing a list you just suppressed. Store the verification date alongside each contact so you know how fresh the status is.
7. Sync back, then keep it clean on a schedule
Push the merged, verified, suppression-aware result back into the CRM. Then treat hygiene as recurring: lists decay continuously as people change jobs, so a database you clean today is measurably worse in six months. Set a re-verification cadence — before major sends and periodically for dormant segments — as laid out in how often to re-verify. A quarterly rhythm beats an annual heroic purge, and it means you never again face a CRM this far gone.
Where CRM cleanups go wrong
- Blasting the whole list to "wake it up." The fastest way to a bounce-and-complaint spike. Verify first, then ramp.
- Deleting instead of suppressing. The next sync re-imports the dead addresses and you repeat the whole mistake.
- Deleting duplicates instead of merging. You lose the deal history, tickets, or notes attached to the "extra" record.
- Treating catch-all and unknown as dead. They're unconfirmed, not invalid — segment them, don't purge real B2B customers.
- No audit trail. You can't prove consent, can't debug later, and can't stop a re-import.
Cleaned in this order, an old CRM becomes an asset again — the good contacts reactivated, the dead weight suppressed for good, and a domain reputation that survives the first send.