How To Buy An Email List Without Torching Your Domain

TL;DR

• Buying a B2B email list is legal in the US under CAN-SPAM and legal in the EU only under a narrow legitimate-interest reading of GDPR — but legality is not the hard part. Deliverability is.
• Most "500,000 verified B2B contacts for $99" lists are scraped, resold, stale, and seeded with spam traps. One send can cost you a domain.
• Legitimate vendors exist. The screen is: named sources, refresh cadence, per-record replacement guarantee, bounce SLA in writing, and a paid sample you verify yourself before buying.
• Expect $0.10–$0.50 per record for credible B2B data, not $0.0002. Anything under about $0.05 per record is a red flag.
• The build path — targeted lists assembled with a domain search plus verification — costs more per contact but usually wins on reply rate, and it never puts your sending domain in someone else's blast radius.

What does "buying an email list" actually mean in 2026?#

Three very different things get sold under the same phrase, and confusing them is how people end up blacklisted.

1. Bulk scraped lists. A CSV of a few hundred thousand addresses harvested from web pages, old breaches, and resold vendor dumps. Price is near zero. Quality is near zero. These are the lists behind almost every "my domain died" story.
2. Licensed database access. A subscription to a maintained B2B contact database — you filter by industry, headcount, title, and geography, then export what matches. You are licensing access, not owning a file. Most reputable providers work this way.
3. Custom-built lists. You define an ICP, a vendor or your own team assembles matching contacts to spec, verifies each one, and delivers a small, targeted file. Highest cost per record, highest hit rate.

When someone says "buy an email list," they usually mean #1 and should mean #2 or #3. The rest of this guide assumes you want data you can actually send to.

Is it legal to buy an email list?#

Short answer: usually yes to buy, often no to send the way you want to send.

United States (CAN-SPAM). Purchasing and emailing a list is legal. You need accurate headers, a truthful subject line, a physical postal address, a working unsubscribe honored within 10 business days, and disclosure if the message is an advertisement. There is no consent requirement. The FTC's CAN-SPAM compliance guide is the primary source — read it rather than a summary.

European Union and UK (GDPR / PECR). You need a lawful basis. For B2B cold email to corporate addresses, legitimate interest is arguable, but you must document a legitimate interest assessment, prove the data was lawfully sourced, and notify the individual within one month of obtaining their data unless an exemption applies. Buying a scraped list makes that notification duty essentially impossible to satisfy honestly. Role-based addresses at limited companies get more latitude than named individuals; sole traders and partnerships are treated closer to consumers.

Canada (CASL). The strictest of the three. Implied consent exists for a business address published conspicuously without a "no unsolicited email" notice, and only where your message relates to that person's role. A bought list rarely establishes this per record.

Two practical consequences. First, ask any vendor for the lawful basis and source for each region — a real vendor answers in specifics, a broker changes the subject. Second, legality does not protect deliverability. Gmail and Microsoft do not read statutes; they read complaint rates.

Where do email list vendors actually get their data?#

Understanding sourcing is the single best filter for separating a database from a dump.

• Publicly crawled web data — company sites, staff directories, press releases, conference pages. Legitimate, but decays fast; job changes run roughly 20% per year in B2B.
• Contributory networks — users install a plugin or sync a mailbox and contribute contacts in exchange for credits. Large coverage, uneven consent hygiene.
• Firmographic partnerships and public registries — company-level records, filings, tech-stack detection. Strong for account data, weak for individual contacts.
• Pattern inference plus verification — the vendor derives the company's email format, generates the likely address for a named person, then validates it at the SMTP layer. Accurate when the verification is real and honest when it reports confidence.
• Resold and breached data — the bottom tier. If a vendor cannot name a source category, assume this.

Any provider you take seriously should publish something equivalent to a data sources page. Vagueness here correlates almost perfectly with bounce rate.

How much should a B2B email list cost?#

Price is diagnostic. Real data has real acquisition and maintenance costs, and no one sells maintained records for a hundredth of a cent.

For reference on credit-based pricing, Tomba pricing runs a free tier at 25 searches per month, Starter at $49/mo, Growth at $99/mo, and Pro at $249/mo, with Enterprise quoted. Compare that shape — searches and verifications you control — against a flat per-record broker fee where you cannot inspect the record until after payment.

One more note on vendors: some list providers, like BookYourData, sell verified B2B records with a bounce guarantee attached, which is a materially different product from an anonymous marketplace CSV. Judge by the guarantee and the sample, not by the category label.

How do you vet a list vendor before paying?#

Run every prospective vendor through this sequence. It takes about a day and has saved more domains than any warmup tool.

1. Demand a paid sample of 100 records drawn from the exact filters you intend to buy — not a curated demo file. If they will not sell a sample, walk.
2. Verify the sample yourself. Run it through an independent email verifier and record the split: valid, invalid, catch-all, unknown. Do not accept the vendor's own verification report as evidence.
3. Set the pass bar before you test. Under 3% hard-invalid and under 15% catch-all is acceptable for B2B. Above that, the full file will be worse — samples are always the vendor's best foot.
4. Check freshness by spot-checking titles. Pull 20 records, confirm the person still holds that role at that company. More than three misses out of twenty means the file is over a year stale.
5. Get the SLA in writing. Specifically: bounce rate ceiling, per-record replacement or credit, refresh cadence, exclusivity (has this file been sold 400 times?), and the lawful-basis statement per region.
6. Search the vendor name plus "review" on G2 and Capterra. Look for deliverability complaints specifically, not general star ratings.

Catch-all domains deserve their own step. A large share of B2B corporate domains accept everything at the SMTP layer, so a naive verifier marks them "valid" and you find out the truth from your bounce report. Use a dedicated catch-all verifier to separate genuinely deliverable catch-all addresses from guesses, and treat any vendor claiming 99% accuracy on catch-all-heavy verticals as either confused or lying.

What happens to your domain when a bought list goes wrong?#

This is the part the "how to buy an email list" guides skip, and it is the part that costs money.

A purchased file typically contains three landmines. Spam traps — recycled abandoned addresses and pristine addresses never used by a human — which are seeded specifically to catch list buyers; hitting a handful signals to Spamhaus and to mailbox providers that you did not collect this data yourself. Hard bounces at scale, where anything above roughly 2–3% starts throttling you at Google and Microsoft. Complaints, where the accepted ceiling is 0.3% and where a genuinely cold, badly targeted list routinely clears 1%.

The failure mode is not "some emails bounce." It is that your sending domain's reputation drops, and then your warm mail — invoices, renewals, replies to inbound leads — starts landing in spam too. Recovering a burned domain takes weeks of reduced volume, and sometimes it is cheaper to buy a new one and start over.

If you are going to send to purchased data anyway, at minimum: send from a separate subdomain, ramp from 20 emails a day, keep your SPF record and DKIM and DMARC correct, and re-verify the entire file the week you send it rather than the month you bought it. Google's own sender guidelines define the thresholds you are being measured against.

Should you buy a list or build one?#

Build, in most cases — and the gap is wider than the price difference implies.

The math that matters is cost per reply, not cost per record. A 50,000-record list at $0.004 that produces four replies costs $50 per reply and a damaged domain. A 2,000-record built list at $0.10 that produces forty replies costs $5 per reply. Volume feels like leverage and is usually just noise.

How to build a targeted list in practice:

1. Define the account list first, not the contact list. Industry, headcount band, geography, tech stack, funding stage — 200 to 500 named companies beats a filter query every time.
2. Pull contacts per domain. Run each company domain through a domain search to surface the people in the relevant departments along with the company's email pattern and confidence scores.
3. Resolve named individuals. When you know the person from LinkedIn or a conference roster, use an email finder to resolve name plus domain into a verified address rather than guessing the format.
4. Verify before export, not after send. Push the file through bulk verification and drop everything that is not deliverable or confidently catch-all.
5. Enrich for personalization. Add the one detail that makes the email non-generic — recent hire, pricing page visit, a tool they run. Data enrichment is what separates a targeted list from a slightly smaller bad list.
6. Suppress aggressively. Existing customers, open opportunities, competitors, previous unsubscribes, and role accounts you do not want to hit. Maintain this file forever.

When is buying a list actually the right call?#

There are legitimate cases. Be honest about which one you are in.

• Offline channels. Direct mail, ads matched to a customer list, ABM audience targeting. No deliverability exposure, so data quality matters less than coverage.
• Market sizing and research. You want to know how many companies in a segment run a given tech stack. You are not emailing anyone.
• CRM enrichment against accounts you already have. Filling in titles and phone numbers on existing records is low-risk and high-value.
• A vertical you cannot reach otherwise — a niche where no public directory exists and a specialist broker genuinely holds the data. Vet twice as hard, buy a sample, start with 500 records.

If your use case is "I need 50,000 cold emails out this quarter," buying a list will not fix that. It will produce activity metrics and a reputation problem. Cut the target, raise the precision.

What should you do in the next 48 hours?#

If you already bought a list: do not send to it. Re-verify the whole file, drop everything invalid and unknown, segment the remainder by ICP fit, take the best 500, and send those from a subdomain at low volume. Watch bounce and complaint rates for a week before scaling anything.

If you have not bought yet: build the account list first. Ten hours of ICP work plus a verified pull beats any file you can purchase this week, and you keep control of every input.

Start with a domain search on twenty target companies, then resolve the named contacts you care about with the Tomba Email Finder — name plus domain in, verified address and confidence score out, with the source shown so you know where it came from. The free tier gives you 25 searches a month to test the accuracy against your own market before you spend anything, and Starter at $49/mo covers most early outbound programs. Verify what you build, keep the list small, and let your domain reputation stay boring.

Related guides#

• B2B Email Lists for Sale in 2026: Buy, Build, or Skip?
• Best B2B Email List Providers in 2026: A Buyer's Guide
• Best B2B Email List Providers in 2026: A Buyer's Guide
• B2B Mailing List: How to Build a Clean One in 2026