Work is scoped against what the sources can actually support. Columns are standardised to one definition each, and the original kept beside it. Coverage is reported as three numbers: matched, unmatched, and unverifiable.
Catch-all detection
Separating addresses that are confirmed from addresses on a domain that accepts anything.
Outlier review
Looking at the extremes of each field, because that is where bad data announces itself.
Authentication
Sender records configured and verified against what the receiving side actually reports.
Describe the exclusions as well as the targets; both shape what is possible.