The Modern Cold Outreach Email Stack
Finding emails for cold outreach in 2026 splits into three problems: (1) finding the right person, (2) finding their email, (3) verifying the email is deliverable. Five years ago, most teams used three different tools, one for each problem. Today the best tools collapse all three into a single workflow. The shift matters for two reasons: speed (one tool replaces three subscriptions) and deliverability (built-in real-time verification beats add-on verification almost every time).
This guide covers seven methods we tested across six weeks of real cold outreach campaigns, ranked by speed, accuracy, and total cost. The TL;DR: if your prospecting starts on LinkedIn, the LinkedIn-first workflow is dramatically faster than domain-based methods. If your prospecting starts from known company lists, domain-based finders (Hunter) still win on UX. Most modern SDR teams use a hybrid: LinkedIn-first for net-new, domain-first for known accounts.
The Three-Problem Framework
Problem 1: Finding the Right Person
"Right person" means someone matching your ICP, title, company, seniority, location. Five years ago this required either ZoomInfo's database UI ("filter by industry, title, company size") or manual LinkedIn search ("VPs of Sales at Series B SaaS in NYC"). Today most teams start on LinkedIn, Sales Navigator filters are more flexible than database UIs and the data is more current.
Problem 2: Finding Their Email
Once you have the right person, you need their email. Three methods: (a) database lookup (ZoomInfo, Apollo, Lusha), fast for common segments, stale for fresh ones. (b) Domain pattern detection (Hunter), fast for known companies, requires you to already have the domain. (c) Real-time extraction (Evascrape), fast for any LinkedIn-found prospect, freshest data.
Problem 3: Verification
Whatever method you use, verify before sending. Bounce rate above 5% damages sender domain reputation across the entire team, a single bad campaign can hurt deliverability for months. Built-in real-time SMTP verification (Evascrape, Apollo) beats add-on verification (NeverBounce, ZeroBounce as separate tools). Real-time verification is also fresher than batch verification of older lists.
Method 1: LinkedIn Search + Email Scraper (Recommended for Most Teams)
The modern SDR workflow: build a LinkedIn or Sales Navigator search, paste the URL into a tool like Evascrape's LinkedIn email scraper, get verified emails for the entire result set in one job. Three-problem framework collapses into one step.
Why It Works
- LinkedIn data is fresher than any database. When someone changes jobs, their LinkedIn updates within hours. Cached databases lag 30-90 days.
- Search filters are more flexible than database UIs. Sales Navigator filters by company growth signals, recent role changes, technology stack, headcount changes, depth that database tools cannot match.
- Bulk extraction is fast. A 5,000-result Sales Navigator search becomes a 5,000-row CSV in 5-10 minutes.
- SMTP verification on every email. No separate verifier subscription needed.
Pricing
Evascrape: $12 per 1,000 verified leads. For a team running 5,000 leads per month, that is $60/month, dramatically cheaper than per-seat database tools at the same volume.
When This Method Wins
LinkedIn-first prospecting (most B2B SaaS, agencies, recruiters). When you do not know the company yet, when your starting point is "find me people matching this ICP," LinkedIn search is the fastest path.
Method 2: Apollo Database + Built-In Sequencer
Apollo combines a 275-million-contact database with sequencing in one tool. Search → list → sequence in the same workspace. Free tier exists; paid plans from $49/seat/month. Apollo's personal-email coverage is strong, especially for SMB segments.
Why It Works
Unified workflow eliminates context-switching between tools. For sequencing-heavy outbound, Apollo's built-in cadence and dialer save the cost of separate Outreach or Salesloft subscriptions.
Limitations
Annual export caps even on paid plans. Cached database (less fresh than live extraction). Per-seat pricing compounds at team scale.
Method 3: Hunter.io Domain Search
For known-company workflows ("find me VPs at acme.com"), Hunter's domain-based finder is the fastest UX in the category. Free tier offers 25 searches/month; paid plans from $49/month. Use our free email format finder for adjacent pattern detection.
Why It Works
For domain-known workflows, Hunter's Chrome extension is one click. Faster than database UIs for narrow lookups.
Limitations
Domain-only, cannot do "find me VPs of Sales at Series B SaaS" without a separate company list first. Monthly subscription wastes slow-month budget.
Method 4: ZoomInfo Enterprise Database
For ABM at enterprise scale with intent data and technographics, ZoomInfo's database depth is unmatched. 321-million records plus Bombora intent signals plus Salesforce-native sync. Annual contract from $15,000+/year.
Why It Works
For enterprise sales orgs running ABM with intent triggers, ZoomInfo's data layer fits the workflow shape perfectly. Dedicated CSM support handles deployment.
Limitations
Enterprise-only economics. Annual contract lock-in. 2-4 week sales-led procurement. Overkill for SMB and most mid-market teams.
Method 5: Manual Email Pattern Guessing
The old-school fallback: figure out the company's email pattern (first.last@, first@, flast@) and guess for each prospect. Free, but slow and error-prone, bounce rate of 30-40% is typical without verification.
How It Works
Use our free email format finder to detect the company pattern from MX records. Then construct guesses for each name. Verify each guess with an SMTP check.
When It Works
Low-volume outbound (under 100 emails per week) where every prospect is high-value enough to justify manual work.
Method 6: Google Maps for Local Businesses
For local SMB outreach (restaurants, agencies, retail, service businesses), Google Maps is a goldmine that database tools miss entirely. Our Google Maps email extractor pulls business listings and visits each website to extract emails.
When It Works
Agencies pitching local businesses. Software companies selling to physical-business segments (HVAC, dentists, real estate, restaurants). Anyone whose ICP is local rather than software-tracked.
Method 7: Manual Research (Last Resort)
Visit websites, check About pages, scrape contact pages by hand. ~30 leads per hour at best. Time-intensive but free, works for high-value prospects where the manual research itself signals investment.
Email Verification: Non-Negotiable
Whatever method you use to find emails, verify before send. Bounce rate above 5% damages sender domain reputation across the entire team, a single bad campaign can suppress deliverability for months across all your sending domains. The math: 1,000 emails sent with 10% bounces means 100 bounces, which most ESPs flag as a quality signal that triggers throttling for weeks.
Verification Methods
- Built-in real-time SMTP (Evascrape, Apollo): Every extracted email is SMTP-verified before delivery. Zero gap between extraction and verification.
- Add-on verification (NeverBounce, ZeroBounce): Run lists through a separate tool before sending. Adds friction and cost.
- ESP-side verification: Some ESPs (Lemlist, Mailshake) offer light verification. Cheaper but less thorough.
Verification Best Practices
- Verify lists older than 30 days before reusing
- Maintain a global suppression list across campaigns
- Honor unsubscribe requests within 24-48 hours
- Monitor bounce rate per campaign and per domain
The Modern SDR Workflow (2026)
Putting it all together, here is how most successful SDR teams structure their cold-email workflow:
- Build ICP search in LinkedIn Sales Navigator. Use Sales Navigator filters to narrow to your ideal customer profile. Save the search.
- Paste URL into Evascrape. The LinkedIn email scraper extracts verified emails for the entire result set in one job.
- Import to your sequencer. Evascrape pushes natively to HubSpot, Salesforce, Pipedrive, or you import the CSV to Outreach, Salesloft, Lemlist, etc.
- Send 4-step sequence with personalized first lines. Personalize line 1 (mentioning recent role change, recent funding, public post). Templatize the rest.
- Track replies, book meetings, iterate. Track open rate, reply rate, meeting-booked rate per ICP segment. Adjust filters and messaging based on what converts.
Cold Email Compliance and Best Practices
For US Outbound
CAN-SPAM applies. Include a clear unsubscribe option, honor opt-outs within 10 business days, do not use deceptive subject lines, include a physical mailing address. Most reputable B2B contact tools handle this automatically.
For EU Outbound
GDPR applies. Use legitimate interest as the legal basis for B2B (which means you must demonstrate clear connection between your offering and the prospect's professional role). Use EU-strong vendors (Cognism, Lusha) or pay-per-lead with public-data-only sourcing (Evascrape). Honor opt-outs within 24-48 hours. Keep an audit trail.
For Both
Send from a verified custom domain (not a generic Gmail). Warm up new sending domains slowly (50-100 emails/day for the first 2 weeks). Use multiple sending inboxes for high-volume sends. Never buy outdated email lists, always source fresh and verify.
Subject Line Best Practices for Cold Email
Subject line determines whether your perfectly-crafted body gets read. Tested patterns:
- Specific question: "Quick question about [their company's recent news]"
- Mutual connection: "[Mutual connection name] suggested we connect"
- Specific pain point: "Are you still using [legacy tool]?"
- Avoid: "Quick question" (generic), "ACTION REQUIRED" (spammy), "Re:" (deceptive)
Subject lines under 6 words tend to outperform longer ones in B2B cold outreach. Test 3-5 subject lines per campaign and keep the highest open-rate winner.
Detailed Comparison: 7 Methods at 1,000 Emails/Month
| Method | Time | Cost | Bounce Rate |
|---|---|---|---|
| Evascrape (LinkedIn-first) | 1 hour | $12 | Under 2% |
| Apollo all-in-one | 2 hours | $49+/seat/mo | 3-5% |
| Hunter (domain-based) | 2-3 hours | $49/mo | 3-5% |
| ZoomInfo (database) | 1 hour | $15,000+/yr | 3-5% |
| Manual pattern guessing | 10-15 hours | $0 + verifier | 15-25% |
| Google Maps (local SMB) | 2 hours | $18/1K leads | 5-8% |
| Manual research | 30+ hours | $0 | 10-15% |
Common Cold Email Finding Mistakes
- Sending without verification. 5%+ bounce rate damages domain reputation. Always verify.
- Using personal email addresses. Sending to john@gmail.com instead of john@company.com triggers stricter spam filters. Prefer business emails when available.
- Reusing old lists without re-verification. Lists older than 30 days have noticeably higher bounce rates. Re-verify or use real-time tools that always pull fresh.
- Sending from a single inbox at high volume. Single-inbox sends above 50/day get flagged. Distribute across multiple inboxes or use a sender like Smartlead.
- Skipping the warm-up period. New sending domains need 2-3 weeks of slow ramp before high-volume sends.
Final Recommendation
For most modern outbound teams, the LinkedIn-first workflow with Evascrape's LinkedIn email scraper is the fastest path from "I want to email VPs at Series B SaaS" to "I have 1,000 verified emails ready to send." The single-tool workflow plus pay-per-lead pricing plus built-in SMTP verification eliminates three separate subscriptions (database + finder + verifier) and three steps of manual work.
For specific edge cases, other methods win: Hunter for narrow domain-based workflows, ZoomInfo for enterprise ABM with intent data, manual research for high-value strategic accounts. Most teams end up with a primary tool (Evascrape or Apollo) plus 1-2 specialized tools for edge cases.
Start with Evascrape free credits for the LinkedIn-first workflow.