Yes, and I've done it from both sides: for agencies selling their own services, and as the outbound engineer inside four lead-gen agencies running campaigns for their clients.
Why agencies are the hardest audience
They run cold email themselves. They recognize spintax. They know what a merge tag looks like when it fails. They get pitched by twenty competitors a week. Every technique that works on a normal buyer reads as amateur to them.
The only thing that survives that filter is demonstrated work. Not a claim that you'd do good work, but evidence, in the email, that you already did some.
The three angles that consistently work on agencies
1. Show them a competitor beating them at something specific
Pull a prospect's top organic keywords and who ranks above them, then enrich for the branded and category terms their positioning implies they should own. Now your first line is: this named competitor outranks you for this exact term, and here's what they're doing that you aren't.
This works because it's competitive, concrete, and slightly uncomfortable. It's also verifiable in one click, which is the bar for this audience. For a marketing agency client, naming the exact competitor and keyword, plus how to beat them without waiting two quarters on SEO, was the whole difference between a skimmed email and a booked call.
2. Scrape their actual ad activity
Ad libraries are public. You can pull who is currently running ads, on what platform, with what creative, and for how long. From there you can qualify: is this a B2B advertiser, are they running the format you specialize in, has their creative gone stale.
On one campaign for a paid-social agency, we scraped live ad activity and qualified which advertisers were actually B2B, then opened by referencing their real, currently-running ads. The personalization wasn't a compliment about their brand. It was proof we'd looked at their account.
3. Detect who's already running outbound
Companies that run cold email at scale buy secondary "burner" domains to protect their primary domain's reputation, and those domains forward back to the main one. That pattern is detectable. When you find it, you've found a company that already believes in the channel. You're not selling them on outbound, you're selling better data, better deliverability, or more capacity.
The opener writes itself: "Saw a few secondary domains forwarding to your main one, are you running outreach off those?" For an enrichment client, filtering the entire list down to companies with detectable burner domains turned a cold list into a pre-qualified one.
Other signals worth building on for this audience
- Competitor followers on LinkedIn. Following a competitor is one of the cleanest intent signals in outbound and almost nobody uses it. On one campaign this pulled 75 qualified leads out of a single competitor's audience without any invented personalization. The relevance was already in the list.
- Hiring signals. An agency posting for a paid media buyer, an SDR, or a GTM engineer is telling you where their capacity gap is this quarter.
- Client-roster changes. A logo appearing or disappearing from an agency's site is a public event with obvious implications.
- Tech-stack and traffic shifts. A traffic decline or a tooling change is a reason to talk that isn't about you.
What I do differently when the client is an agency
Two things change. First, the copy gets shorter and drops every convention agencies associate with mass mail: no exclamation openers, no "hope this finds you well," no fake compliment. Second, the proof has to be inside the email, because they will not click through to a case study page to be convinced.
And when I'm working inside an agency as the outbound engineer, the requirements shift again: everything has to be multi-tenant. Separate workspaces or scoped clients, separate suppression lists per client, separate reporting, and hard isolation between accounts. A client's do-not-contact list is theirs alone. Applying one client's suppression across the whole book would quietly delete a large share of another client's valid ICP. I've measured that overlap; it's not hypothetical.
The honest expectation
Agency-to-agency outbound has lower reply rates than most categories and higher-quality conversations when it lands. The people who reply have already self-selected as taking you seriously, because they've seen a thousand versions of the email that don't work.
The LinkedIn ads, competitor-SEO, competitor-followers, and burner-domain campaigns in the case studies are all versions of this.