Every B2B prospecting project hits the same wall. You exported a list of company domains from a directory, a Google Maps scrape, or a conference attendee page. The list is real. The companies are real. But a domain is a building, not an inbox, and you cannot send a building an email. This guide walks the precise four-stage pipeline that gets you from acme.io in a cell to a verified jordan.lee@acme.io you can actually write to — and it is honest about the numbers, because the tools that promise a 95% hit rate are selling you bounces.
Stage 0: clean the domain column first
Garbage domains in, garbage contacts out. Before anything crawls, spend two minutes flattening your column to bare root domains. The crawler wants acme.io, not https://www.acme.io/pricing?ref=ad. Strip the scheme, drop the www., cut everything after the first slash, lowercase it, and dedupe. A list that arrives clean enriches noticeably faster and costs less, because you are not paying to crawl the same domain three times under three URL spellings.
Stage 1: crawl, because the email is never on the homepage
The single biggest reason a "domain to email" run comes back thin is that the tool read only the page you gave it. Business addresses cluster on deep pages. A finder is only as good as how aggressively it follows internal links to reach them. These are the pages that actually carry contacts, roughly in order of yield:
| Page | What you find there | Notes |
|---|---|---|
/contact | A global address or, increasingly, just a form | Obvious but often dead-ends in a form with no address. Cannot be your only target. |
/about, /team, /people | Named, role-specific addresses: founder, head of partnerships | The highest-value page. This is where personal emails worth reaching live. |
/imprint, /impressum, /legal | A real, legally mandated contact email | In Germany, Austria and much of the EU a legal imprint is required by law, making this a goldmine for European targets. |
| Site footer | A catch-all like hello@ or info@ | Repeated on every page; reliable but generic. |
Obfuscated mailto: / JS | Addresses written as "name [at] domain" or injected late | A finder that executes the page and de-obfuscates catches these; a raw-HTML one misses them entirely. |
The lesson is counter-intuitive: depth beats breadth. A crawler that visits the contact, about, team and imprint pages of one domain finds more usable addresses than one that scrapes a thousand homepages. That is the entire job of a website contact finder — following the links and reading the deep pages so you do not click through 1,000 sites by hand.
Stage 2: classify, because not every address is the same lead
Treating info@acme.io and jordan.lee@acme.io as interchangeable is why a lot of campaigns flop. Keep the type next to every address so you can route them differently downstream:
- Role / generic (
info@,sales@,hello@) — lands in a shared inbox, easy to ignore, but low compliance risk. Fine for a first touch or a tiny business with no other address. - Personal / named (
jordan.lee@) — reaches a human, far higher reply rate, but it is personal data under GDPR and it goes stale the day that person leaves. - Pattern-guessed (a derived
first.last@domain) — cheap to fabricate, dangerous to trust. Never send to a guess you have not verified.
Hold onto the source page too. An address pulled from /team is a far stronger signal than one scraped from a 2019 blog comment.
Stage 3: verify, and know exactly what "verified" buys you
"Verified email" is sold as a guarantee. It is not. Verification means two specific, mechanical things: the domain has valid MX records (it can receive mail at all), and an SMTP probe suggested the mailbox exists without a hard rejection. That genuinely matters — it strips the obvious bounces that otherwise tank your sender reputation. But be clear on the ceiling: it does not prove the person still works there, it does not predict whether a spam filter eats your message, and catch-all domains accept every address you try, so they come back "accept-all / risky", never truly "valid". Read verification as "unlikely to bounce", not "will be read".
Stage 4: dedupe and route
Collapse to one good contact per company — ideally the best-classified named address, falling back to a role inbox, falling back to a phone or social if there is no public email at all. Dedupe, then export to CSV or push straight into your CRM or sequencer. Here is the whole pipeline as a single stage view, end to end:
The actual API call
The crawl-and-extract step is the one you should never build yourself — following links, executing JS and de-obfuscating addresses across thousands of sites is a maintenance trap. As a single API call against the Website Contact Finder Actor it looks like this:
curl -X POST "https://api.apify.com/v2/acts/renzomacar~website-contact-finder/run-sync-get-dataset-items?token=<APIFY_TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"websites": ["acme.io", "studio-nord.de", "example-clinic.com"],
"maxDepth": 2,
"includePhones": true,
"includeSocials": true
}'maxDepth: 2 is the sweet spot. It reaches the contact and team pages one or two clicks in without crawling the entire blog archive. Push it higher only for sprawling sites where the imprint is buried deep. The response is one JSON record per domain, each carrying the emails found, their source page, plus any phones and socials — ready to pipe into the classify and verify stages.
The hit-rate math nobody shows you
Plan with honest numbers so your pipeline forecast survives contact with reality. Here is a realistic walk-through for a 1,000-domain B2B list:
→ Crawl finds at least one public address on ~78% → 780 domains with a raw email.
→ Drop hard-invalid + catch-all/risky on verification (~22% loss) → ~608 deliverable.
→ Of those, a named personal address on roughly 40% → ~243 high-reply contacts; the rest are role inboxes.
Net: ~60% of the list becomes a deliverable contact, ~24% a named human. The 36% with no usable email are small businesses with a form or phone only.
If a vendor promises a deliverable email on 95% of domains, they are counting unverified pattern guesses to pad the number. Those guesses bounce, and bounces are not free.
first.last@ guesses per company will bounce and torch your sending domain's reputation, which then sinks deliverability for the good addresses too. Optimise for a low bounce rate, not a fat row count. A list that is 60% real and clean outperforms one that is 95% padded and toxic.Turn your domain column into real contacts
The Website Contact Finder crawls each site's contact, about, team and imprint pages, de-obfuscates hidden addresses, and returns emails, phones and socials with the source page attached — ready to verify and route. Free Apify credits to start.
Run the Website Contact Finder → Or get done-for-you leadsFAQ
How many domains actually return a usable contact?
For a normal B2B list, expect a deliverable email on roughly 45–70% of domains after verification. Small local businesses skew lower because many publish only a phone or a form; established companies with team and imprint pages skew higher. Distrust any "95% coverage" claim — it is almost always padded with unverified guesses.
Should I guess emails like first.last@domain instead of crawling?
Only as a last resort, and never unverified. Pattern guessing produces addresses that look right but bounce, and bounce rate poisons your sending reputation so even your good emails stop landing. Crawl for the published address first; verify any guess with MX and SMTP before it touches a send.
Is doing this and cold-emailing legal?
It depends on where the recipient sits — see the legal note above. In short: US CAN-SPAM is permissive for truthful B2B mail with an opt-out; EU/UK GDPR and PECR demand a lawful basis and favour role addresses over named personal mailboxes.
Disclosure: links to Apify on this page are affiliate links, marked rel="sponsored". If you create a paid account through them we may earn a commission at no extra cost to you. We recommend Apify because we build and ship Actors on it ourselves, including the Website Contact Finder linked above. Nothing here is legal advice; check the rules that apply to your recipients before sending.