How To Get Email Addresses For Marketing (2026 Playbook)

TL;DR

• There are exactly three legitimate sources of marketing email addresses: people who opt in, publicly available business contacts you find and verify, and enriched records you already own. Everything else is a purchased list waiting to wreck your domain.
• Opt-in lead magnets produce the highest engagement (20-40% open rates) but the slowest volume. Domain-based prospecting produces volume fast, but only works for B2B under legitimate-interest rules.
• Verify before you send. A list that bounces above 3% will get you throttled by Google and Microsoft within one campaign.
• Budget roughly $0.01-$0.10 per verified B2B email if you find them yourself, versus $0.15-$0.50 per contact from a packaged data vendor.
• The order that works: define the segment → find the domains → extract the addresses → verify → warm the sending domain → send.

What counts as a legitimate way to get email addresses for marketing?#

Start with the constraint, because it decides everything downstream: the method you use to get an address determines what you are legally allowed to send to it.

Three buckets, and only three:

1. Consent-based collection. Someone gave you their address knowingly — newsletter signup, gated content, webinar registration, free tool, checkout. This is the only bucket that works for B2C marketing in GDPR jurisdictions, and the only bucket that works at all for marketing automation sequences in most of the EU.
2. Publicly available business contacts. Role and named addresses at companies, sourced from company websites, press pages, WHOIS-adjacent records, and public professional profiles. Under GDPR this runs on legitimate interest (Article 6(1)(f)) and under CAN-SPAM it is legal outright, provided you identify yourself and honor opt-outs. This is B2B territory only.
3. First-party enrichment. You already have a record — a signup with a work domain, a CRM row with a name and company, a website visitor you've identified — and you fill in the missing email. Legally you inherit the basis of the original relationship.

Anything outside those three is a purchased list. Scraped consumer databases, "500K verified leads for $99" marketplaces, list rentals from a defunct publisher — those are the reason a third of cold-email programs die in month two.

How do the seven main methods actually compare?#

Here is the honest scoreboard. "Cost per usable address" assumes you verify before sending; "usable" means it lands in an inbox and belongs to a real person in your ICP.

Two things jump out. First, opt-in methods cost 20-100x more per address but convert several times better — they are not competing categories, they are different funnel stages. Second, the cheapest scalable channel for B2B is finding addresses yourself from company domains, which is why most outbound teams run that as the spine and layer the rest on top.

How do you build an opt-in list that actually grows?#

Opt-in is slow and boring and it is still the best asset you will build. The mechanics have not changed much; the execution bar has.

1. Pick one high-intent magnet, not five. A benchmark report, a template pack, a calculator. Five mediocre PDFs collect fewer addresses than one thing people actually want. Test with paid traffic before you commit design resources.
2. Ask for the minimum. Email only converts 2-3x better than email + name + company + phone. Collect the rest through progressive profiling on visit two.
3. Use double opt-in for anything EU-facing. Yes, it drops raw signups 15-30%. It also removes typo addresses and spam traps before they touch your list, which is worth more than the vanity count.
4. Put the form where intent peaks. End of a long-form post, exit intent on pricing, inline in the docs. Sidebar forms are decoration.
5. Send within 60 seconds. Deliver the magnet immediately and follow with a 3-5 email sequence over two weeks. Lists that go cold for 90 days after signup bounce and complain like purchased lists.
6. Prune quarterly. Anyone who hasn't opened in 180 days is dragging your sender reputation down. Run a re-engagement campaign, then suppress.

A free utility tends to outperform a PDF by a wide margin because the value is instant and repeatable. That is the same logic behind giving away a free email checker or a subject line generator — the tool does the acquiring.

How do you find B2B email addresses at scale?#

This is the fastest path from "I know who I want to reach" to "I have their address," and it is where most B2B marketing lists actually come from in 2026.

The workflow is four steps.

Step 1 — Build the company list. Pull domains, not people, first. Sources: G2 category pages, funding announcements, job-board postings that reveal the tech stack, conference exhibitor lists, your own website visitor identification data. Aim for 500-2,000 domains in a defined segment rather than 50,000 across everything.

Step 2 — Extract addresses per domain. A domain search returns every discoverable address at a company plus the pattern it uses (first.last@, flast@, first@). Once you know the pattern, you can construct addresses for named targets you couldn't find directly. For named individuals you already have, run the email finder with first name, last name, and domain.

Step 3 — Verify everything. Non-negotiable. SMTP-level checks catch dead mailboxes, syntax errors, disposable domains, and role accounts. Catch-all domains — where the server accepts every address whether or not it exists — need a dedicated catch-all verifier, because a standard check returns "unknown" and most teams then guess.

Step 4 — Enrich for personalization. Title, seniority, company size, tech stack. An address without context produces generic copy, and generic copy produces the 1% reply rates that make people blame the data.

Match rates matter more than raw database size here. A vendor claiming 500 million contacts is telling you about their warehouse, not about your ICP. Test any provider on 100 domains from your segment and measure three numbers: found rate, verified-deliverable rate, and hard-bounce rate after a real send.

Which tools should you use, and what do they cost?#

The market splits into email finders (find + verify addresses on demand), verification-only services, and full data platforms (contacts + intent + sequencing). You usually need one from column A and possibly one from column C.

For reference points on the platform end, look at G2's lead intelligence category rather than vendor landing pages — the review filters let you sort by company size, which is the variable that actually changes the verdict.

Tomba pricing runs Free (25 searches/mo), Starter $49/mo, Growth $99/mo, Pro $249/mo, and Enterprise custom, with the finder, verifier, domain search, and enrichment on the same credit pool — which is the practical reason to consolidate rather than stitching three subscriptions together.

On the curated-database side, providers like BookYourData sell pay-as-you-go, pre-verified B2B segments with a bounce guarantee. That model is genuinely useful when you need a specific vertical fast and don't want to build the domain list yourself; the tradeoff is that you're buying a snapshot rather than querying live. Many teams run both: a curated pull for the initial TAM sweep, live finding for the accounts they actually care about.

What are the legal rules you cannot ignore?#

Short version: CAN-SPAM is permissive, GDPR is not, and the difference is whether the recipient is a person or a business.

• CAN-SPAM (US). No opt-in required. You must use accurate headers and subject lines, disclose that it's an ad where relevant, include a physical postal address, and honor unsubscribes within 10 business days. Penalties run to five figures per violating email.
• GDPR (EU/UK). Consumer marketing needs consent. B2B marketing to a role-based business address can run on legitimate interest, but you must document a balancing test, name your data source in the first email, and honor erasure requests. Germany and Austria are stricter than the EU baseline — treat them as consent-only.
• CASL (Canada). Among the strictest. Express or clearly implied consent required, with records of when and how it was obtained.
• State privacy laws (US). California, Colorado, Virginia, and a growing list give consumers deletion and opt-out rights that apply to marketing databases regardless of CAN-SPAM.

The operational takeaway: keep a source and acquired_at field on every contact record. When a deletion request or a regulator's question arrives, "we don't know where this came from" is the answer that costs money. The ICO's direct marketing guidance is the clearest free reference for the UK/EU side.

How do you keep the addresses you collected from bouncing?#

Collecting is half the job. A perfect list sent from a cold domain still lands in spam.

Verify at two points. At capture (real-time API check on the form) and again before each send if the list is older than 60 days. B2B email data decays at roughly 2-2.5% per month as people change jobs — a year-old list is a quarter dead.

Warm the sending domain. New domain or new mailbox: start at 10-20 sends/day and ramp over 3-4 weeks. Use a warmup calculator to plan the curve rather than guessing.

Get authentication right before volume. SPF, DKIM, and DMARC are mandatory for bulk senders at Google and Yahoo since 2024 — a missing DMARC record is now a hard block, not a soft penalty. Check yours with an SPF checker and confirm your DMARC policy is at least p=none with reporting enabled. Google's own bulk sender guidelines are the authoritative spec.

Watch three numbers, weekly. Hard bounce rate (keep under 2%, panic above 3%), spam complaint rate (keep under 0.10%, Google's threshold is 0.30%), and open-rate trend by mailbox provider. A Gmail-only open collapse means a Gmail-specific reputation problem, not a copy problem.

Segment by engagement, not just firmographics. Sending your whole list every time is how a good list becomes a bad one. Your best-engaged 20% can take weekly mail; the rest should get monthly at most.

What does a realistic 30-day plan look like?#

If you are starting from zero and need a working marketing list inside a month:

Week 1 — Define and source. Write the ICP down to firmographic filters you can actually query. Build a domain list of 500-1,500 companies. Set up SPF, DKIM, and DMARC on a separate sending domain from your primary corporate domain.

Week 2 — Extract and verify. Run domain search across the list, then the finder for named targets. Verify everything, including catch-alls. Expect 55-75% found rate on a well-defined B2B segment; below 40% means your domain list is wrong, not your tool. Start mailbox warmup in parallel.

Week 3 — Enrich and segment. Add titles, headcount, and one personalization variable you can actually reference in copy. Split into 3-4 segments with distinct angles. Simultaneously, ship one opt-in magnet so the compounding channel starts running.

Week 4 — Send small, measure hard. 50-100 sends per day per mailbox, maximum. Read bounce and complaint rates before you scale anything. If the bounce rate holds under 2% and replies land above 3%, double volume weekly. If not, fix the list before you fix the copy — bad data looks exactly like bad copy in the metrics, and only one of them is cheap to fix.

Run bulk operations through a bulk email finder rather than one-off lookups once you're past a few hundred records; the per-credit economics and the CSV round-trip both improve significantly.

Where should you start?#

Start with the segment you can describe in one sentence, then get the addresses for it — not the other way around. The teams that struggle with "how to get email addresses for marketing" almost always have a targeting problem dressed up as a data problem.

For the sourcing layer, Tomba Email Finder covers the whole chain on one credit pool: find addresses by name or domain, verify them (including catch-all domains that other tools return as "unknown"), and enrich the records before they hit your sequencer. The free tier gives you 25 searches a month to test match rates on your own ICP before spending anything — which is exactly the test you should run on every provider on this list, including this one.

Related guides#

• How to Build an Email List for Marketing in 2026 (Field Guide)
• How to Get B2B Email Leads That Actually Convert in 2026
• How to Buy B2B Leads in 2026 Without Burning Your Domain
• B2B Email Marketing Lists: How to Build One That Converts in 2026