Cold Email to Local Service Businesses: Finding Owner Emails

To cold email local service businesses such as roofers and HVAC contractors, build the list from public records and maps data, get the email from each company's website or by guessing and verifying an address on its domain, then verify everything before sending. Owner addresses beat generic inboxes, and some firms will have no findable email at all.

Local service businesses are a different prospecting problem from tech companies. There is no LinkedIn profile for most roofing company owners, many firms run on a Gmail address and a phone number, and the data providers built for SaaS sales have thin coverage. Here is a workflow that works with what is actually available.

The data sources, and what each one gives you

No single source has the owner's name, the company's domain and a working email together; you assemble them.

Source	Gives you	Does not give you
State licence databases	Business name, licence holder's name, licence status	Email, usually website
Google Places API	Phone number, website URL, address, reviews	Email (no such field)
The company website	Domain, contact email, sometimes owner name	Whether the email works
Email finder	A likely address for a name at a domain	Certainty without verification
Verifier	Whether the mailbox exists	The address itself

Licence data: names you can trust

Licensed trades come with public records that name a real person, which is the hardest piece to get elsewhere. We pulled the Texas Department of Licensing and Regulation's All Licenses dataset through its public API on 1 October 2026 to see what it actually contains for HVAC.

• 20,436 records with the licence type "A/C Contractor".
• 18,961 of those had an expiry date on or after 1 October 2026.
• Every unexpired record had an owner name (the licence holder), and 18,609 had a business name.
• The dataset has no email column. In our export, the business telephone and business address fields were empty for these records.

So licence data gives you a verified business name and a person's name, and nothing to email. Note that the licence holder is not necessarily the company owner; at some firms it is an employee who holds the licence. Confirm on the company's website.

Not every trade is licensed. Texas, for instance, does not require roofing contractors to hold a state licence; the Roofing Contractors Association of Texas runs a voluntary programme. For unlicensed trades you start from maps data instead.

Google Places: website and phone, no email

Google's Places API returns a business's phone numbers and website, but there is no email field. The Places data fields documentation lists nationalPhoneNumber, internationalPhoneNumber and websiteUri as the contact fields, all in the Place Details Enterprise tier.

The website URL is the valuable part. It gives you the domain, and the domain is what turns a name into a findable email address. Businesses with no website listed will mostly have no domain email, which tells you to expect a Gmail address or a phone-only contact.

From website to email address

Check the website first, then fall back to finding and verifying an address on the domain. In order:

1. Contact page and footer. Small trades sites typically publish a single address, such as info@, office@ or a Gmail address.
2. About or team page. Gives you the owner's first name if licence data did not.
3. Guess the owner's address on the domain. Patterns worth testing first are firstname@, first.last@ and firstinitiallastname@. Our guide to company email formats covers how to test a guess.
4. Use a finder. The email finder takes a name and a domain and returns an address only after checking it with the mail server.

Do not scrape addresses you cannot see as a visitor, and do not generate dozens of guesses and send to all of them. Guessing and sending is the fastest way to a high bounce rate. Guessing and verifying costs nothing in reputation.

The three kinds of address you will end up with

Local business lists split into owner addresses, generic inboxes and free-mail addresses, and each behaves differently.

Type	Example	Verification	How to treat it
Owner on domain	mike@smithroofing.com	Usually confirmable unless catch-all	Best segment; personalise
Generic on domain	info@smithroofing.com	Usually confirmable unless catch-all	Lower priority; may reach office staff
Free mail	smithroofing@gmail.com	Gmail rejects unknown mailboxes, so a clear result	Fine to send if it is clearly the business's address

Two things are worth knowing about this table.

Generic inboxes are role addresses. Verifiers commonly flag them separately (ours does), because they are shared, sometimes unmonitored, and more likely to generate complaints. At a three-person HVAC firm info@ may be the owner's main inbox; at a fifty-person firm it may go to a dispatcher. You cannot tell from the address. Our post on role-based addresses covers when they are worth sending to.

Gmail addresses are easier to verify than domain addresses. Gmail rejects unknown recipients during the SMTP conversation, so a fake or mistyped Gmail address shows up as invalid. Some small business domains are set up as catch-all, which accept every address and can only be returned as risky.

Verify, then segment the send

Verify the whole list before the first send, and split it by result and address type.

1. Invalid: drop. Do not retry with a different guess unless you have a reason.
2. Valid, owner address: your primary campaign.
3. Valid, role address: separate campaign, smaller daily volume, message written for whoever opens the shared inbox.
4. Risky (catch-all): small test batch first; continue only if bounces stay low.

Bounce rates matter more than usual here because local campaigns are often sent from a handful of new inboxes on a secondary domain. A few dozen hard bounces in the first week of a new domain does lasting damage. See secondary domains for cold email and the warm-up schedule for the sending side.

The rules that apply

B2B email to local businesses is still covered by anti-spam law. This is not legal advice.

• US: the FTC's CAN-SPAM guide states the law makes no exception for business-to-business email. You need accurate header information, a non-deceptive subject line, a valid physical postal address and an opt-out honoured within 10 business days. Penalties are up to $53,088 per email.
• UK: under PECR the electronic mail marketing rule does not apply to corporate subscribers such as limited companies, but sole traders and some partnerships are treated as individuals and need specific consent or the soft opt-in (ICO B2B guidance). Plenty of trades businesses are sole traders, so check the business type before you add a UK firm to a cold campaign.

What to expect

Expect gaps. A list of local trades businesses will include firms with no website, firms whose only contact is a phone number, and owners who never read email. That is not a data quality failure; it is how a lot of these businesses run.

The practical plan:

• Email the firms where you found and verified an owner or business address.
• Call the firms where you only have a phone number. If a business lists only a phone number, that is the channel it expects to be contacted on.
• Do not pad the list with unverified guesses to reach a target number. A smaller verified list sends from a domain that is still healthy next month.

The takeaway: build local business lists from public records for names and Google Places for domains, get emails from the website or by verified guessing, and send owner addresses and generic inboxes as separate segments. Run a sample through the free verifier before you commit a new domain to the campaign.