How to Cold Email a Business Lead List That Gets Replies
A raw list of businesses is not a campaign. This guide covers personalizing cold emails from public business data, setting up SPF, DKIM, and DMARC, warming up a sending domain, and staying CAN-SPAM compliant.
Quick Answer: To cold email a business lead list well, personalize each message using category, rating, review count, and web presence, set up SPF, DKIM, and DMARC before you send, warm up a new domain gradually, and follow CAN-SPAM rules on honest headers and opt-out.
You pulled 200 dentists, HVAC contractors, or med spas out of a zipcode search and now you have a spreadsheet of names, phone numbers, and websites. The list is the easy part. Turning it into a cold email that gets replies instead of complaints is where most outreach falls apart. ExtractData is a local business data platform that turns a zipcode and category search into structured records — name, phone, address, website, rating, and, on paid plans, an extracted email address — so this guide assumes you already have that raw material and need to know what to do with it.
What makes cold email different from spam?
Cold email is a first message sent to someone who did not ask to hear from you, built around specific research on their business rather than a mass template blasted to a purchased list. The difference is not the lack of an opt-in — it is whether the message is honest about who is sending it and whether it is actually relevant to the person opening it.
In the United States, cold email to a business is legal under the CAN-SPAM Act as long as you follow a short list of rules covered later in this guide. That is different from consumer email in the EU under GDPR, which generally requires opt-in consent before you contact someone at all — this guide covers US B2B outreach only.
How do you personalize a cold email from public business data?
The strongest personalization hooks are the fields already sitting in your export: business category, star rating, review count, and whether the business has a working website. Each one is specific to that business, which is what makes an opening line believable instead of generic.
Compare "I saw you're a business owner and wanted to reach out" to "I noticed your HVAC listing has 40+ reviews but no working site — most of your competitors in that zip code have one." The second line proves you looked at their record before writing, and it only took one real data point to do it.
- Business category and sub-category (a dentist gets a different pitch than a med spa)
- Star rating and review count, used as a signal, not flattery
- Presence or absence of a working website
- City or neighborhood, when it changes the pitch (seasonal HVAC demand, local competition)
Use one real detail per email, not three stacked together. A single accurate observation reads as research; three in a row reads as a mail-merge field dump.
What do SPF, DKIM, and DMARC actually do?
SPF, DKIM, and DMARC are three DNS records that tell an inbox provider your domain really sent the email it just received, and each one proves a different piece of that claim.
| Record | What it proves | Where you set it |
|---|---|---|
| SPF | This mail server is allowed to send for this domain | A TXT record on the sending domain |
| DKIM | This message was not altered in transit | A signed header plus a public-key TXT record |
| DMARC | What to do if SPF or DKIM fails, and who to report it to | A TXT record referencing an SPF and DKIM policy |
Without all three configured, major inboxes like Gmail and Outlook are more likely to route your message to spam no matter how good the copy is. The DMARC.org overview explains how the three records work together as a single authentication chain.
How do you warm up a new sending domain?
Domain warm-up means sending a small, steadily increasing volume of email from a new domain so inbox providers learn to trust it before you rely on it for real volume.
- Buy a separate sending domain rather than using your main company domain for cold outreach
- Send a small batch of email daily instead of one large batch weekly
- Increase volume gradually over several weeks instead of jumping straight to bulk sending
- Mix in messages that get real replies, not just one-way sends
- Watch for bounces and spam complaints and pause sending if either one climbs
The goal on bounces and spam complaints is not a target percentage — it is keeping both as close to zero as you can, because a spike on a brand-new domain does more damage than the same spike on an established one.
How do you keep a lead list clean before you send?
Bad data burns domain reputation faster than bad copy. Before you send a single email, re-check that the businesses on your list are still open, that phone numbers and addresses are current, and that you have removed duplicates that show up twice under slightly different names. A separate guide covers how to verify a business list before you import it in more detail.
This step gets tedious fast once a list passes a few hundred rows, which is exactly the point where most people either quit or start guessing. A structured export that already carries rating, review count, and website status attached to each record — the kind of plan-level export ExtractData provides — removes most of that manual checking before you ever open a spreadsheet.
When should you call instead of email?
Not every lead deserves the same first touch. The signals in the record itself tell you which channel is more likely to work.
| Signal | Better first touch | Why |
|---|---|---|
| High rating, recent reviews, active-looking listing | Call | The business is clearly staffed and answering the phone during business hours |
| No website, sparse or old reviews | A slower first touch gives an under-resourced owner time to read it on their schedule | |
| Franchise or multi-location brand | Email to a named contact, not the front desk | Calls to a front desk rarely reach anyone with purchasing authority |
What does CAN-SPAM actually require?
CAN-SPAM does not require the recipient to opt in before you email them, but it does require you to be honest and to make it easy for them to say stop.
- A subject line that accurately reflects the content of the email
- A real, working postal address in the message
- A clear way to opt out, honored within 10 business days
- No harvested or purchased consumer email lists
- Clear identification if the message is an advertisement
The FTC's CAN-SPAM compliance guide is the primary source for all of the above and worth reading once in full, not skimmed.
The most common objection to this whole approach is that cold email to a business you found through a search feels like spam even when it technically is not. The honest answer: it is not spam under US law as long as you follow the rules above, and it is not the same as harvesting personal consumer data — ExtractData pulls business records from official Google Places and Yelp Fusion APIs, not by collecting personal profiles or buying bulk lists. If a recipient still finds it unwelcome, honoring their opt-out immediately is what keeps the difference real.
The bottom line
Personalize from data you already have, get SPF, DKIM, and DMARC in place before your first send, warm up gradually, and follow CAN-SPAM to the letter. Pull one zipcode and trade, create a free account, export the list, and send five personalized emails today using one real detail from each record.
Frequently asked questions
Is cold emailing businesses legal in the US?
Yes. The CAN-SPAM Act allows unsolicited commercial email as long as the subject line is honest, the message includes a real postal address, and you honor opt-out requests within 10 business days. Unlike GDPR-style rules elsewhere, CAN-SPAM does not require the recipient to opt in first.
How many emails should I send when warming up a new domain?
Start with a small daily batch rather than one large weekly send, then increase volume gradually over several weeks while watching bounce and spam-complaint rates. Jumping straight to bulk volume from a brand-new domain is the fastest way to land in spam folders.
Do I need SPF, DKIM, and DMARC before my first cold email?
Yes. Without all three, major inboxes like Gmail and Outlook are more likely to route your message to spam regardless of how good the copy is, because each record proves a different piece of the claim that your domain actually sent the message.
What data points work best for personalizing a cold email?
Business category, star rating, review count, and whether the business has a working website are the strongest hooks, because they are specific to that business and show you looked at the record before writing, rather than merging a generic field.
Should I call or email a business lead first?
Call first when the business has a strong recent rating and looks actively managed, since someone is likely answering the phone. Lead with email when there is no website or the listing looks stale, since a slower first touch gives an under-resourced owner time to read it.
How do I keep a business lead list from going stale?
Re-check phone numbers, addresses, and site status regularly, drop listings marked permanently closed, and de-duplicate by phone number and address rather than business name alone, since the same business often appears twice under slightly different names.
Reviewed by the ExtractData Team — lead-generation and business-data guidance, updated August 2026.
Start extracting business data today
5 free searches daily. No credit card required.
Start extracting data free →