Where to get emails for cold emailing, and why a bought list is the fastest way to lose a domain

Cold email addresses come from three places: B2B data platforms such as Apollo, ZoomInfo, Cognism, Lusha and Clay; LinkedIn Sales Navigator searches enriched into addresses; and company websites, where an address is found by pattern and confirmed by a verifier. What the three have in common is that you build the list one contact at a time against a definition of who you want, and every address is verified before it is sent to. What you do not do is buy a file.

How do you define who the list is for?

Before any source, write down who you are looking for in one paragraph a stranger could act on. A title or a small set of titles, because the person who feels the problem is not always the one who buys the fix. A company size band, because a 20-person company and a 2,000-person company with the same title have different jobs. An industry or a handful of them. A geography, which decides which laws apply. And a trigger: something that makes this month the right month to write, such as a new hire in the role you sell to, a funding round, a job advert for the work you replace, a technology they have just adopted, or an office they have just opened.

The trigger is the part most lists skip and the part that does the most work. A list of 2,000 marketing directors is a list of people with nothing in common but a title. A list of 200 marketing directors at companies that advertised for a demand generation manager last month is a list of people with a reason to read. Both cost the same to build. One of them replies.

Write the definition down and keep it with the list, because every source below is filtered by it, every verifier result is judged against it, and when a campaign fails the first question is whether the list matched the definition or the definition was wrong.

Where do cold emailers actually get email addresses?

The starting point is not a source but a definition: which titles, at companies of what size, in which industries and places, and what makes now the moment to write. Every source below is a way of turning that definition into addresses, and a source without the definition produces a list that is large, cheap and useless.

Why should you never buy a cold email list?

Because it bounces, because everyone who bought it is mailing it too, and because the domain that pays for both is yours. A bought list is old by definition: the addresses were collected some time ago, people change jobs, and a share of every file is already dead. Providers start treating a sender as a list-quality problem at roughly 5% bounces, and bought files commonly land well above that on the first send. The same file has also been sent to by every other buyer, so the recipients who remain are the ones who have learned to hit report.

Sending to purchased, scraped or rented lists is prohibited on the inboxes we provide, and the reason is not squeamishness. Reputation is shared: the tenant, the IP ranges and the domain all carry it, and one bought list can take a batch of healthy domains down with it. Our own bounce rate of 1.73%, 461 of 26,698 contacted, came from lists we built and verified, and the DNS would not have saved a bought file.

How do you build a list from a B2B data platform?

A B2B data platform is a searchable database of people and companies with filters on title, seniority, department, company size, industry, location, technology used and funding. Apollo, ZoomInfo, Cognism, Lusha and Clay are the ones most cold emailers use; Apollo and Clay also connect to the sequencers and inboxes directly, which is why they turn up in the integrations list of every sending tool.

1. Write the definition first and build the filters from it. Title and seniority, then company size and industry, then a trigger where the platform has one: recent funding, a hiring signal, a technology in use.
2. Export in batches of a few hundred, not thousands. A small batch gets verified and sent within the week; a ten-thousand-row export is stale before it is finished.
3. Keep the platform's own confidence field. Most mark addresses as verified, guessed or catch-all, and a guessed address goes to the verifier before it goes anywhere else.
4. Verify the batch anyway, with a separate verifier. Platforms re-check on their own schedule, and the address that was valid at last check is the one that bounces.

How do you turn LinkedIn Sales Navigator into email addresses?

Sales Navigator has the most current title data anywhere, because people update their own profiles, and no email addresses at all. The workflow is a Navigator search built from the same definition, exported to a sheet, and enriched: a tool takes name and company and returns an address. Clay runs several enrichment providers in sequence and stops at the first hit, which is the most thorough version; Apollo's extension, Findymail, Prospeo and Dropcontact do the single-provider version. Enrichment returns an address for somewhere between half and three quarters of a list, depending on the industry, and every returned address is then verified.

The cost is a Navigator seat plus a few cents per enriched address, and the payoff is a list where the title is right this month. For campaigns where the person matters more than the volume, this is the source to use.

How do you find an email address from a company website?

Most companies use one address pattern for everyone: first.last, first, firstinitiallast. Find one confirmed address at the company, on the site, in a press release or a filing, and the pattern gives you the rest. A verifier then confirms whether the address you built exists. This is slow, it is free, and for a list of thirty companies you genuinely want it is the most accurate source there is.

The caveat is catch-all domains. A domain configured to accept mail for any address will verify every guess as valid, because it accepts everything and sorts it out afterwards. Catch-all addresses get a separate, smaller send, watched for bounces that arrive after acceptance.

Which source fits which campaign?

The three sources trade volume against precision, and the campaign decides which you need. A data platform is the right source when the definition is broad and the numbers matter: several hundred contacts a week across many companies, where a title being three months out of date on a few of them is a cost you can carry. Navigator plus enrichment is the right source when the person matters: a short list of accounts, a title that has to be exactly right, a message that refers to something specific about them. The website method is for the thirty accounts you would rather win than any hundred others, where an hour per company is a good trade.

Most teams run two of the three. The platform fills the sequencer at the rate the inboxes can carry, and Navigator builds the smaller list that gets the personalised message. What they share is the verifier at the end, and the definition at the start. A source is not a strategy; the definition is.

How do you verify email addresses before sending?

A verifier checks that the domain has mail servers, that the mailbox exists, and whether the domain is catch-all, without sending a message. NeverBounce, ZeroBounce, MillionVerifier and Bouncer do this for a fraction of a cent per address, and the whole batch takes minutes. Each address comes back as valid, invalid, catch-all or unknown.

Verification is the step that decides bounce rate, and bounce rate is the first number a receiving provider reads about you. It is also where the infrastructure and the list meet: authenticated inboxes carry what they are given, and a verified list on inboxes with SPF, DKIM and DMARC already verified is how our 1.73% was reached. Either half alone does not get there.

How many contacts do you need?

Fewer than most people build. Work backwards from sends. On Microsoft 365 a mailbox is safe at about 3 cold emails a day, so 100 mailboxes on one domain is 300 sends a day. A sequence of three messages means each contact consumes three sends over a couple of weeks, so a domain at full rate absorbs about 100 new contacts a day, or around 2,000 a month. A first campaign of 200 to 300 contacts is enough to read the bounce rate and see whether replies arrive, and small enough that a bad list costs a week rather than a domain.

Is it legal to email addresses you found?

For business addresses, in most jurisdictions, yes, with conditions that are the sender's to meet. CAN-SPAM in the United States permits unsolicited commercial mail provided the sender is identified, the subject is honest, an opt-out is offered and honoured within ten days, and a postal address appears. GDPR and PECR in the EU and UK allow business-to-business outreach under legitimate interest when the message is relevant to the role, you have recorded why, the person can object easily and the objection is respected; consumer addresses are a different regime. CASL in Canada allows implied consent for a business address that is conspicuously published, relevant to the role, and not accompanied by a statement refusing unsolicited mail. Sourcing an address lawfully does not make the message lawful; both have to hold.

What list hygiene looks like after the first send

• Every bounce leaves the list the day it happens, and the sequencer's bounce handling is switched on before the first send.
• Every unsubscribe and every "not interested" goes to a suppression list that all future campaigns check against.
• Replies stop the sequence, which the sequencer does; a reply that lands after the second follow-up is the sign it is not.
• Addresses older than about 30 days are re-verified before a new campaign. People change jobs; the list does not notice.
• Bounce rate is read per campaign and per source. A source that bounces at 5% is dropped, whatever it cost.