How to generate B2B leads in 2026: a source-quality playbook

An ICP that says "B2B SaaS, 50–500 employees, growing" is not an ICP, it is a wish. A working ICP for outbound needs three coordinates that are queryable against a register or a register-equivalent source:

• Industry code — NACE Rev. 2 in the EU, SIC 2007 in the UK, NAICS in North America, WZ 2008 in Germany. Without an industry code you cannot dedupe, you cannot segment, and you cannot exclude. Use the codes the source actually publishes.
• Region — country plus, for larger countries, region or state. A campaign aimed at "Germany" without a Bundesland filter will mix Hamburg shipping firms with Bavarian Maschinenbau in a way that makes the copy generic.
• Size band — turnover band or employee band, taken from a filed accounts source where possible. Self-reported headcount on LinkedIn is roughly 30% wrong in the SME band; filed accounts are not.

If you can express your ICP in three lines using only those three coordinates, you are ready to source. If you cannot, the rest of the funnel will be downstream noise.

Aggregators (Apollo, ZoomInfo, Cognism, Lusha) are convenient. They are also derivative — they aggregate LinkedIn signals, scraped websites and purchased lists. Whatever is not in those upstream sources is not in the aggregator. In continental Europe specifically, that means an aggregator-only stack systematically misses the owner-led mid-market.

The first-best source for any country is the national register. These are:

• UK — Companies House, free, REST API, ~4.8M active companies, SIC-coded
• Germany — Handelsregister + Bundesanzeiger, ~3.5M GmbHs, annual filings under § 325 HGB
• France — INPI/RNE via data.inpi.fr, SIRENE database for company identifiers
• Netherlands — KvK Handelsregister
• Spain — Registro Mercantil Central
• Nordics — Norway (Brønnøysund), Sweden (Bolagsverket), Denmark (CVR), Finland (PRH)

The discipline is: registry first for entity, size and director name; aggregator second for any LinkedIn-derived behavioural signal; web analysis third for the actual email address that a human reads.

An English-only analysis over German, French or Italian sites will silently truncate your list. The 60-person Maschinenbau firm in Stuttgart publishes its Impressum and team page in German. The Lyonnais consultancy publishes its mentions légales in French. If your enrichment layer reads only English, you get the half of the site that is the "about us" stub and miss the people you actually want to email.

Practical enrichment targets per company: legal-notice page (Impressum / mentions légales / aviso legal), team or leadership page, contact page, careers page. From those four pages a competent engine extracts: named email addresses, role-based mailboxes, direct phone numbers, named leadership with titles, current open roles. That last one is the most underrated buying signal in B2B.

The order of operations matters. Send before deliverability is set up and you burn the domain. Set up takes a day, recovery from a burned domain takes months.

• SPF — published TXT record, includes all legitimate senders, ends in -all not ~all once you trust the list
• DKIM — 2048-bit key, rotated yearly, configured per sending provider
• DMARC — start at p=none with rua reporting, move to p=quarantine after two weeks of clean reports, then p=reject
• Dedicated sending domain — outreach.yourdomain.com or a separate domain entirely. Never use the primary corporate domain for cold sends
• Warm-up — 20-30 sends per day per inbox in week one, climb to 80-150 by week four. Use a warm-up tool (Mailwarm, lemwarm, the built-in tools in Instantly and Smartlead)
• Mailbox provider monitoring — Postmaster Tools at Google, Smart Network Data Services at Microsoft

The shortcut of "firstname.lastname@domain.com" is wrong about 35-45% of the time outside the US. European naming conventions, umlauts, double-barrelled surnames and married-name changes all break pattern guessing. The right approach is a two-tier verify:

1. MX lookup on the domain — confirms a mail server actually exists
2. email RCPT TO probe — asks the receiving server whether the mailbox accepts mail, without sending one

Tools like NeverBounce, ZeroBounce, Hunter Verifier and DeBounce do this, typically for $4-8 per thousand verifications. Some inbound servers (notably catch-all configurations and several large enterprise filters) reject email probes; for those, the verification result will be "unknown" and you decide your risk tolerance.

The single biggest distortion in outbound discourse is the LinkedIn humble-brag screenshot showing a 12% reply rate. For cold B2B email, against a list that is segmented but not specifically triggered, the honest band looks like this:

Above 6% sustained, on a list larger than a few hundred contacts, is almost always one of three things: a list of warm contacts mislabelled as cold, a fit signal so tight it is effectively a referral list, or a deliverability problem where the message reads as spam to filters but humans never see it and reply numerators look inflated against suppressed denominators. None of those are repeatable.

The short version: cold B2B email is legal in most major jurisdictions if you are relevant, transparent and easy to opt out from. The longer version, by region:

• EU under GDPR — Article 6(1)(f) (legitimate interest) is the basis. The message must be relevant to the recipient's professional role, the sender must be identifiable, and an opt-out must be a single click. Function mailboxes (info@, sales@, einkauf@) are not personal data under Article 4 and sit outside GDPR entirely.
• UK under UK GDPR + PECR — corporate subscribers (Ltd, PLC, LLP, Scottish partnerships) do not require prior opt-in for electronic marketing. Sole traders and ordinary partnerships are treated as individuals and need soft opt-in.
• Germany under UWG + GDPR — explicitly allowed for B2B by DSK guidance; the DSK is the joint federal-state body of data protection authorities.
• France under CNIL — stricter. CNIL guidance treats named B2B addresses as needing legitimate interest plus a relevance test that is harder to meet than in Germany. Function mailboxes are clearer.
• Italy under Garante — similar to France, stricter on consent than the German line.
• US under CAN-SPAM — accurate header, no deceptive subject, physical postal address in the footer, a working opt-out. No opt-in required.
• Canada under CASL — opt-in required, with narrow business-relationship exceptions. Materially stricter than CAN-SPAM.