Cold Email List Building for Agencies: ICP to Verified Inbox

Vlad Timinski· September 21, 2026· 6 min read

Most cold email list building for agencies starts in the wrong place. The guide sells a tool, dumps a scrape into a CSV, and calls the result a pipeline. Then the domain burns, replies go quiet, and everyone blames the subject line. I see the same failure on accounts that arrive already damaged: the list was never built to protect the inbox. It was built to look large.

Cold email and LinkedIn are the primary channels I run for Space Sales. List quality is the quiet half of cold email. The other half is cold email deliverability for agencies: domains, warmup, and sender rules. This post is the list side: who not to email, clean enrichment, verification, and never-mail lists.

I will not invent reply rates, open rates, or meeting rates. There is no public cold email dataset I would stand behind. Method, public sender rules, and operating conventions only. I will label which is which.

Cold email list building for agencies starts with who not to email

If your ideal client profile is vague, every enrichment tool will fill it with noise. "Agencies that need leads" is not an ICP. "Founders of 10 to 40 person B2B service firms who sell a defined offer above a price floor you can name" is closer. The point is exclusion.

I start every list build by writing who I refuse to email:

• Titles that cannot buy or block the deal
• Company sizes outside the band where your offer still makes sense
• Industries you cannot serve well
• Existing clients, open opportunities, and anyone who already said no
• Role accounts (info@, hello@, support@, sales@) when you need a named buyer

Accounting firms are not my ICP, and I do not pretend they are. A verified address at the wrong company is still a wasted send. The filter is the product. Scraping is the easy part.

Enrichment without garbage fields

Enrichment means a usable work email and enough context to write one relevant line. It does not mean stuffing every field into the CRM.

What I need on a cold row, most weeks: company domain, person name, a title that maps to buying, one email candidate, and a short reason the company fits. I drop phone numbers I will not call, social URLs I will not use, fluff that never appears in the message, and vendor "confidence scores" I cannot audit. Extra columns create false comfort.

Pattern guessing (firstname@, flast@) can generate candidates. It is not verification. Treat every guess as unverified until a verifier says otherwise.

Verify before send: catch-alls, role accounts, risky patterns

Verification is how list building protects the domain. A bounce tells Gmail and Microsoft you are mailing addresses you never confirmed exist. That is classic spam behavior, and mailbox providers score it that way.

Public rules first. Google's email sender guidelines tell bulk senders to authenticate with SPF, DKIM and DMARC, support one-click unsubscribe on marketing and subscribed mail, and keep spam rates reported in Postmaster Tools below 0.30%, with below 0.10% recommended. Yahoo publishes matching sender requirements. Microsoft added high-volume sender requirements in May 2025 for mail into Outlook.com, Hotmail and Live. Read the scope yourself: those volume thresholds are written for consumer mailboxes. Company mail sits on Workspace and Microsoft 365 tenants that filter on their own terms. Authentication is still the floor everywhere. Complaint math is still the game. List quality is how you stay on the right side of both.

Verification conventions next, labeled as conventions:

• Run every new batch through an email verification service before it touches a sending inbox
• Keep hard bounces out. Soft results get a second look, not a blind send
• Catch-all domains often verify as "unknown". Careful senders usually suppress them rather than gamble. That is practitioner convention, not a published Google rule
• Role accounts tend to route to shared inboxes and rarely create a clean buying conversation. I suppress them on named-buyer campaigns
• Disposable domains and repeated failure patterns get cut as a batch

My operating line matches the deliverability convention: keep hard bounces under about 1 percent, and pause to clean when a list approaches that line. Convention among careful senders, not a measured law. Prefer a smaller clean list. Volume is replaceable. A burned domain is not.

The infrastructure half lives in the deliverability post. List building and deliverability are one system.

Suppressions and never-mail lists

Verification cleans what never existed. Suppressions clean what should never hear from you again.

Build a never-mail list and treat it as sacred:

• Anyone who replied "not interested", "remove me", or equivalent
• Hard bounces and addresses that failed verification
• Current clients and open opportunities
• Competitors you have no business emailing
• Seed or test inboxes used for placement checks

Match every new export against that list before enrichment finishes. Reply handling belongs here too: a negative reply that fails to stop the sequence is how irritation becomes a spam complaint, and complaints are the metric Google publishes targets for. Most weeks the suppression pass removes fewer rows than people expect and prevents more damage than any subject-line test.

How list building protects deliverability

Mailbox providers do not read your positioning doc. They read bounces, complaints, engagement, and whether mail looks wanted. A scraped list of dead addresses and wrong titles fails on contact. A tight ICP with verified inboxes and a current suppression file gives the domain a chance.

If the list is wrong, the plumbing fails even when SPF, DKIM and DMARC pass. For channel choice, see cold email, LinkedIn and Upwork. Cold email only wins when the list and the domains are both assets.

When LinkedIn is the better first touch for the same ICP

Same ICP, different door. When the email is unverifiable, catch-all, or missing, and the person is active on LinkedIn, I would rather spend a connection invite than force a bad address into a sequence. LinkedIn has its own plumbing: weekly invite caps, commonly around 100 to 200 and undocumented, covered in LinkedIn outreach limits.

Use LinkedIn when fit is obvious and the inbox path is weak. Use email when the address is verified. Running both at the same person in the same week without a plan looks uncoordinated.

Build the list like the domain depends on it

Cold email list building for agencies is not a scrape contest. It is an exclusion contest that ends in a verified, suppressed, ICP-matched file small enough to respect the inbox.

The order I actually run:

1. Write the ICP and the explicit exclusion list
2. Enrich only the fields the message needs
3. Verify, and drop catch-alls and role accounts when the campaign needs a named buyer
4. Suppress never-mail and past decliners
5. Only then load a sending platform

Skip a step and you are not moving fast. You are borrowing reputation from a domain that has to last longer than this week's campaign.

If you want a second pair of eyes on a list before it touches a warmed domain, book a call. I will walk through your ICP, your verification pass and your suppressions with you, and tell you straight what I would cut first. The conversation is about cold email and LinkedIn first.

Vlad Timinski

Founder of Space Sales. I run cold email and LinkedIn lead gen for B2B service businesses. Start with the free diagnostic if you want a read before a call.