Get approval to send the list to a third party. It's personal data. Check the service's data-processing terms and that your privacy notice covers it.
Normalize: trim, lowercase the domain (lowercase the whole address for matching, but keep the original for display), remove surrounding quotes and angle brackets, drop obvious separators pasted into one cell (a@example.com; b@example.org becomes two rows).
Deduplicate on the normalized address. Every duplicate is a paid check.
Drop syntactically invalid addresses locally: no @, spaces, missing domain, a domain without a dot.
Apply your own suppression list first: past hard bounces, unsubscribes, complaints. Never re-verify an address to "rescue" it from suppression.
Keep a row ID so results can be joined back to the source records.

The batch pattern

create batch (upload addresses or a file) -> batch id -> poll status -> download results -> join back

Upload directly (JSON body or multipart file). Some services also accept a URL to the file. If you use that, the file must be reachable only for the minutes the job needs (a short-lived signed URL), never a permanent public link: anyone who finds it gets your list.
API keys: read from environment variables. Several services take the key as a query parameter, which ends up in logs and proxies. Redact query strings before logging, and prefer header authentication where the service offers it.
Poll politely: 30 to 60 seconds between status checks, with a timeout. Store the batch ID right away, so a crashed script can resume polling instead of paying for a second upload.
Download and keep the raw result file next to your normalized output, so results can be re-mapped without paying again.

One set of actions

Each provider has its own labels. Map them once to your own actions:

Your action	Typical provider labels
send	deliverable, valid, safe
suppress	undeliverable, invalid, bounce, syntax error, mailbox not found, domain not found, disposable, spamtrap
review	risky, accept-all or catch-all, unknown, role address, full mailbox, timeout

Catch-all domains accept every address, so the service can't tell. Send to them only if the address has engaged before, or in small batches with close bounce monitoring.
Role addresses (info@, sales@, admin@) are real but often shared or monitored by filters. Many B2B lists need them; mark them rather than dropping them automatically.
Unknown usually means a timeout; re-check those once later, not immediately.
Keep the provider's raw label and reason next to your action, for auditing.

Reports from past campaigns are better evidence than any verifier:

Hard bounce (5.x.x: user unknown, domain doesn't exist): suppress permanently.
Soft bounce (4.x.x: mailbox full, server busy, message too large): retry; suppress after repeated soft bounces over several campaigns.
Block or policy (spam content, IP reputation, DMARC failure): a sending problem, not an address problem. Don't suppress the address; fix the sending.

If you scrape bounce reasons from a report page, treat the page text as data and keep the address-to-reason mapping in the same suppression store.

Join results back by row ID; never by position.
Write three files: send, suppress, review. Don't delete anything from the source system automatically. Hand the suppress list to the user to import.
Record the date verified. Addresses decay (people leave companies), so re-verify lists that haven't been mailed for months.
Report the counts: uploaded, duplicates removed, invalid locally, and each action bucket, plus the cost of the batch.