How to find B2B leads with verified emails (without buying a database)
The fastest way to burn a sending domain is to upload a purchased list. Bought databases are 6–18 months stale, full of role addresses and spam traps, and everyone else bought the same file. Building your own list takes a bit more work, but the emails are fresh, verified and yours. Here is how we do it, with the numbers.
1. Decide exactly who you want (one line)
Vague targeting produces vague lists. Write one sentence with four parts: role, type of company, size or stage, place. For example: "founders of marketing agencies with 5–30 people in Madrid" or "heads of operations at e-commerce brands in the UK doing €1–10M a year".
Add one signal if you can — something that makes them likely to need you now: hiring for a role, a recent funding round, a new website, a bad review, a job post mentioning a tool you replace. A list of 100 people with a signal beats 1,000 without one.
2. Find the people (four free sources)
LinkedIn through Google
LinkedIn's own search is limited on a free account, but Google indexes millions of public profiles. Search operators like:
site:linkedin.com/in "founder" "marketing agency" Madrid
Change the role and the sector, use synonyms ("CEO", "co-founder", "owner"), and search in the language of the market ("agencia de marketing" finds different people than "marketing agency"). Each query gives you 10–30 profiles; variety of queries beats depth.
Company websites
For small companies the team page is the best source: real names, current roles, and — crucially — the company domain, which you need for the next step. Directories like Clutch, G2 or the local chamber of commerce give you the companies; the website gives you the people.
Google Maps for local businesses
Dental clinics, gyms, restaurants, real estate offices: Maps listings have the website and often a public email. Reply rates are lower than with named people, but for local services it is the only list that exists.
Communities, events and podcasts
Speaker lists, sponsor pages, Slack and Discord member directories, podcast guests. These lists are small but the people are active and reachable — perfect for a signal-based campaign.
3. Get the email address
Once you have a name and a company domain, most business emails follow a pattern: first@, first.last@, f.last@, firstl@. Two ways to find the right one:
- Email finder services take name + domain (or a LinkedIn URL) and return the address. Good ones only charge when they find something — typically €0.01–0.05 per verified email. Use two in sequence ("waterfall"): if the first finds nothing, try the second. Coverage jumps from ~50% to 70%+.
- Pattern guessing + verification: generate the 4–6 common patterns for the domain and run them through a verifier. Free, works well for small companies, fails on catch-all domains.
Whatever you use, get the company domain first. "Acme" is ambiguous; acme-agency.com is not. If you only have the company name, resolve it (a search for the name plus "site" or a company-autocomplete API usually does it).
4. Verify every address before it goes in a campaign
Verification is three checks: syntax (is it a valid address), MX (does the domain accept mail) and mailbox (does the server say this user exists). The result is one of four states:
| Result | Meaning | What to do |
|---|---|---|
| Valid | Server confirmed the mailbox | Send |
| Invalid | No such mailbox or domain | Delete — every one of these is a bounce |
| Catch-all / risky | Domain accepts anything, mailbox unconfirmed | Send in a separate small batch, watch bounces |
| Unknown | Server refused to answer (greylisting, Microsoft, policy) | Send, but cap the share of unknowns at ~20% of the campaign |
Target: bounce rate under 2% on the first campaign. If a batch bounces above 5%, stop, find the bad source and fix it — mailbox providers remember.
5. Enrich only what you will use
You need three things per lead to write a good first line: their role, their company and one specific detail (the signal from step 1, a recent post, what the company does in one sentence). Everything else — revenue estimates, tech stack, 40 columns of firmographics — is noise you will never use in a 90-word email. Enrich the 50 people you will actually contact this week, not 5,000.
6. Keep the list clean
- Deduplicate by email and by company. Emailing three people at a 10-person company in the same week gets you reported.
- Suppress existing customers, active deals, competitors and anyone who ever opted out. Keep that suppression list forever.
- Drop role addresses (info@, sales@, hello@) and free-mail addresses unless the business genuinely runs on them.
- Refresh every 3–6 months. People change jobs; last year's verified email is this year's bounce.
7. A note on the law
B2B cold email is legal in most places when you write to people in their professional role, say who you are, make your purpose clear and honor opt-outs quickly (in the EU this rests on "legitimate interest" under GDPR and the ePrivacy rules; in the US on CAN-SPAM). What gets companies fined is consumer data, bought lists with no source, and ignoring unsubscribes. Keep a record of where each lead came from. This is not legal advice — check your market.
What this looks like in practice
For a list of 200 agency founders in one city: 30–40 Google/LinkedIn queries, 200–300 profiles found, domains resolved for most, emails found for 60–75%, 2–4% of those invalid after verification. Net: roughly 120–150 sendable, verified contacts from a couple of hours of work — and a bounce rate you can live with.
Frequently asked questions
Is it legal to cold email someone who never gave consent?
For business-to-business email it is generally allowed in most jurisdictions when you contact people in their professional capacity, identify yourself clearly and honor opt-outs (the EU relies on "legitimate interest", the US on CAN-SPAM rules). Never email consumers from bought lists, and remove anyone who asks. This is not legal advice — check the rules for your market.
What percentage of prospects will I get a verified email for?
In our experience 40–70% depending on the niche: founders and agency people are easy (often 80%+), corporate roles at large companies harder. Expect a lower rate for very small businesses with no website.
What is a catch-all email and should I send to it?
A catch-all domain accepts mail for any address, so a verifier cannot confirm the mailbox exists. They are "risky": send to them in a separate, smaller batch and stop if bounces go above 3%.
Should I email info@ or sales@ addresses?
Almost never for cold outreach. Role addresses rarely reply, often feed spam traps and hurt your reputation. Find a named person instead.
How often should I refresh a lead list?
Every 3–6 months. Around 20–30% of B2B contacts change role, company or email each year, so a list you built last year will bounce.