Sized first, built second.

Every selection opens with a definition somebody can disagree with. Each pass is reversible, so a filter can be loosened without starting again. Every claim the file makes about itself can be checked against it.

Catch-all detection

Separating addresses that are confirmed from addresses on a domain that accepts anything.

Intake review

Reading an existing file and reporting what is wrong with it before any work is proposed.

Authentication

Sender records configured and verified against what the receiving side actually reports.

The first build is deliberately small, by preference.