Almost every outbound team on earth builds lists from the same three places: Apollo, LinkedIn Sales Navigator, and a ZoomInfo export. Which means they're all emailing the same people, and those people are exhausted. If your campaign underperforms, the list is a more likely culprit than the copy.
Here's the method I use to reach the rest of the market.
1. Start from the market, not from the database
The wrong question is "what filters do I set?" The right question is "where does this type of company necessarily appear in public?" Every market has a place its members must show up:
- Software companies appear in product directories: Product Hunt, GetLatka, GetApp, Toolify, SourceForge, Crunchbase.
- Local businesses appear on Google Maps and in vertical directories tied to the platforms they operate on.
- Anyone who transacts in property or capital appears in county and registry filings.
- Anyone who spends on ads appears in ad libraries.
- Anyone with customers appears in review platforms and app stores.
- Anyone hiring appears in job boards, with the shape of their problem written in the job description.
- And anyone paying attention to a category appears in that category's follower and community lists.
The good sources are usually the ones that require work: a scraper, an API you have to learn, a paginated site, a bulk file you have to process. That friction is the entire reason the list is uncontested.
2. Use several sources for the same market
No single source is complete, and the gaps aren't random. A concrete example: bulk pre-scraped business databases cover some Google Maps categories thoroughly (tens of thousands of auto body shops, print shops, machine shops) while containing well under 1% of the actual US construction trades. If you'd trusted one source for a roofing campaign, you'd have built a list that looked fine and covered almost nothing.
So I run multiple sources per market and dedupe on domain, then reconcile. Overlap tells you your coverage is real. No overlap tells you one source is missing a segment.
3. Resolve entities into people
Most non-obvious sources give you a business, not a buyer. Bridging that gap is the actual skill:
- Resolve the business to a domain, and normalize the company name, stripping legal suffixes, parent-company tails, and service descriptors so the brand survives for use in copy.
- Find people at that domain through people-search APIs, splitting large pulls by country and seniority to work around per-query result caps, then deduping on LinkedIn URL.
- Where the source exposes no titles, infer role with an LLM from available context, then verify against the site rather than trusting the inference.
- For hard-to-reach lists, keep multiple contact points per company (personal, role-based, and generic) instead of insisting on one perfect address that may not exist.
4. Run a measured email waterfall, not a favorite vendor
This is the part I'm most opinionated about, because most teams pick a provider on reputation and never test it. I ran a controlled evaluation of six email-finding providers over the same 5,000 contacts to establish a real order. What it showed:
- An internal validated-email cache resolved roughly 2,400 of 5,000 for free, once a 45-day freshness rule was applied.
- The single highest-coverage provider found about 4,400 of 5,000 on its own, and was also the most expensive, which is exactly why it belongs late in the chain rather than first.
- An unlimited-tier provider found about 2,400 and, critically, added 739 net new contacts after the cache. Net-new-after-the-previous-step is the only number that matters in a waterfall; standalone coverage is a vanity stat.
- The next provider added 439 after that, the one after it added 121, and a slow tail provider mopped up the remainder.
- Email guessing found 105 of 5,000 and contributed single digits of net-new. It isn't worth the validation cost.
- Every simulated ordering topped out around 4,650 of 5,000. Once you know the working provider set, ordering is purely a cost and speed decision.
So the production rule is: short-circuit per contact. The moment a contact has an accepted, validated email, stop calling providers for that contact. Cheap and free steps first, expensive coverage step last.
5. Validate, and re-validate
Everything goes through bulk validation, and only verified-good addresses make the final list unless a client explicitly accepts the risk. Cached emails older than about 45 days get re-validated before reuse. This is unglamorous and it's the difference between a domain that lasts a year and one that burns in six weeks.
6. Qualify before you send
A big list is worthless if half of it isn't the ICP. Before anything enters a sequence, each row runs through an LLM check on the things a filter can't see: does this company actually do the thing, does the site match the thesis, is the pricing model right, is there evidence of the pain. I calibrate those prompts on a small sample, validate against a larger one, and only then score the full set.
7. Suppress properly
Before upload: scrub the client's own do-not-contact list at both domain and person level, dedupe against everything previously sent, and check overlap with other campaigns. After upload: verify by exporting the campaign and comparing normalized emails against what you intended to send. I've watched a bulk upload report success while silently dropping 16,000 leads because of one inverted API flag; the only reason it got caught was the export check. Trust the export, not the response code.
The tradeoff, stated honestly
These lists are smaller, slower to build, and more expensive per row than an export. They are also dramatically more responsive, because you are frequently the first relevant email that prospect has received in months. That trade is worth making almost every time.