← All posts
· 8 min read

Finding Prospect Emails for Cold Outreach (Without a Stale Apollo List)

enrichmentdatadeliverabilityGDPRverification

Most cold email problems people blame on copy or deliverability are actually data problems.

You can write the best email in the world. If it goes to an outdated address, a catch-all that swallows everything, or the wrong person entirely, none of it matters. The reply rate is zero before the recipient is even in the picture.

Finding prospect emails is the least glamorous part of cold outreach and the part that quietly decides whether the rest of the system works. Bad data inflates bounce rates, burns your sending domains, and wastes the personalization work you did downstream.

Here’s how to actually find correct emails, and the mobile numbers and off-LinkedIn contacts most people never reach.

Domain search is the foundation. You have a company, you need the people at it.

The pattern you’re looking for is the email format a company uses: first@, first.last@, flast@, firstinitiallast@. Once you know the pattern for a domain, you can construct an address for anyone there with reasonable confidence.

Hunter.io is the standard tool for this. Feed it a domain and it returns the most common email pattern plus the addresses it has already seen, scored by confidence. Apollo does the same inside a larger sales database. Both are fine starting points.

But here’s the trap: domain search alone gets you a guess, not a verified address. Hunter telling you the pattern is first.last@ doesn’t mean jane.doe@company.com exists; it means it probably follows the format. Pattern-guessed emails are where most bounce problems start.

Domain search gets you a hypothesis. Verification turns it into a usable lead. Never skip the second step.

Domain search also breaks down on two common cases: catch-all domains (which accept any address, so verification can’t confirm anything) and companies that use a different format for executives than for everyone else. Both are reasons you don’t rely on a single source.

Waterfall enrichment: catch what one provider misses

No single data provider has good coverage. Apollo might have 60–70% of your list. Hunter might have a different 50%. Neither has all of it, and the overlap isn’t complete.

The fix is waterfall enrichment: running each lead through multiple providers in sequence, so a miss from the first provider gets a second, third, and fourth chance downstream.

How a waterfall works

The logic is simple. For each lead:

  1. Try Provider A. If it returns a verified email, stop.
  2. If A misses, try Provider B.
  3. If B misses, try Provider C.
  4. Keep going until you get a hit or exhaust the chain.

You only pay for the providers you actually need per lead, and your overall coverage jumps from “whatever one tool has” to the union of everything you queried.

Clay is the tool most teams use to build this. It lets you chain enrichment providers in a single table (Apollo, then Hunter, then Dropcontact, then a phone-number provider) with conditional logic that only fires the next step when the previous one came up empty. Dropcontact is worth including specifically because it computes and verifies emails algorithmically rather than reselling a static database, so it often catches what the database tools miss.

Why order matters

Put your cheapest, highest-coverage provider first and your expensive, specialized ones last. That way the bulk of your list resolves cheaply, and you only spend on premium sources for the hard 20–30% that everything else missed.

A well-built waterfall takes a list from maybe 60% coverage on a single tool to 85–95%, and the addresses that come out the far end have already passed through multiple checks.

Email verification: keep bounce rate under 2%

This is the step that protects everything else.

Every email you send to a dead address is a bounce, and bounces are the fastest way to wreck a sending domain. Mailbox providers read a high bounce rate as a signal that you’re sending to a scraped, unmaintained list: exactly the behavior of a spammer. Keep your bounce rate under 2%. Under 1% if you can.

Run every address through a verifier before it ever enters a sequence. Tools like MillionVerifier, NeverBounce, and ZeroBounce check whether a mailbox actually exists without sending a real email. They’ll sort your list into valid, invalid, risky, and catch-all.

Handle each bucket deliberately:

  • Valid: send.
  • Invalid: remove. Non-negotiable.
  • Catch-all: these accept any address, so the verifier can’t confirm the specific mailbox. Send to them in smaller, separate batches so you can monitor bounces without risking your whole campaign.
  • Risky / unknown: exclude, or run them through a second verifier for a tie-breaker.

Verifying twice with two different tools on the borderline addresses is cheap insurance. The cost of a verification credit is nothing next to the cost of a burned domain.

One more rule: data decays. People change jobs constantly, and B2B email lists rot at roughly 25–30% per year. Re-verify any list older than a few weeks before reusing it.

Finding contacts who aren’t on LinkedIn

Here’s where most outreach quietly fails. The standard playbook, Sales Navigator export plus Apollo, only ever finds people who maintain an active LinkedIn presence with a discoverable email. That’s a fraction of your real market.

Plenty of the buyers you want aren’t there. Founders of bootstrapped companies, operators in traditional industries, technical decision-makers who deleted their profile years ago, executives who keep a deliberately thin online footprint. If your sourcing starts and ends with LinkedIn, these people simply don’t exist in your pipeline, and your competitors aren’t reaching them either.

Finding them takes OSINT-style sourcing, not a database export:

  • Company websites and team pages: about pages, leadership bios, and press releases name people who never appear in sales databases.
  • Domain WHOIS and registration records: often surface a founder’s direct contact details.
  • Industry directories, association rosters, and licensing boards: gold for regulated and traditional industries.
  • Conference speaker lists, podcast guests, and webinar panels: public, specific, and rarely scraped by everyone else.
  • Mobile numbers: phone-enrichment providers (chained into the same waterfall) get you a direct dial. For some segments, a well-timed call or text outperforms email entirely.

The point isn’t to replace email; it’s that a contact record with a verified email and a mobile number gives you a second channel when the inbox goes quiet. That’s the difference between one shot and two.

Staying compliant: GDPR, legitimate interest, and opt-out

If you’re emailing prospects in the EU or UK, compliance isn’t optional. It’s also not the blocker people assume it is: B2B cold email is workable under GDPR, but only if you do it deliberately.

Legitimate interest is your legal basis. GDPR allows processing personal data without prior consent when you have a legitimate interest, provided it doesn’t override the individual’s rights. For B2B outreach, that means contacting someone in a professional capacity about something genuinely relevant to their role. Emailing a VP of Sales about sales tooling is defensible. Emailing a random personal address about something unrelated to their job is not.

Relevance is what makes legitimate interest hold up. The more targeted your list, the stronger your position. This is one more reason tight ICP targeting matters: it’s not just better for reply rates, it’s your compliance argument.

A few concrete rules:

  • Identify yourself clearly. Real name, real company, no disguised sender.
  • Make opt-out effortless. Every email needs an easy way to say “stop.” Honor it immediately and permanently: suppress that address across all future campaigns.
  • Honor deletion requests. If someone asks to be removed from your records entirely, do it.
  • Keep a record of your reasoning. Document why your outreach qualifies as legitimate interest. If you’re ever asked, “we documented our basis” beats “we didn’t think about it.”
  • Avoid personal-domain addresses (Gmail, Outlook personal accounts) for EU/UK prospects. Stick to corporate addresses tied to a professional role.

Compliance and good practice point the same direction here: targeted, relevant, easy to unsubscribe from. The senders who get in trouble are the ones blasting bought lists with no opt-out: the same senders whose deliverability is already in the gutter.

The bottom line

Finding prospect emails isn’t one task. It’s a pipeline: domain search to find the pattern, waterfall enrichment to maximize coverage, verification to protect your domain, off-LinkedIn sourcing to reach people your competitors can’t, and compliance baked in from the start.

Most agencies skip most of this. They export an Apollo list, drop it into Instantly, and send. That’s why they all deliver the same stale leads: the same contacts everyone else is already emailing, with the same outdated addresses.

At BuyerBrains we run a proprietary in-house OSINT and waterfall enrichment pipeline, built per client rather than resold from a single database. It finds the contacts who aren’t on LinkedIn, with correct emails and mobile numbers, verified before anything ships. If your current data is the reason your campaigns underperform, that’s the part we’d start with.