Recruiter cold email has the highest open rates in the industry - passive candidates open 35-55% of sourcing outreach because the message is directly relevant to their career. But poor personalisation, spam trigger words, and unverified email lists are killing response rates for many recruiters. This guide covers how to source candidate emails, how to write outreach that gets replies, and how to stay compliant in 2026.
The safest channel - no sourcing of personal email needed. InMail open rates are 25-35% (lower than email but GDPR-safe). For 1st-degree connections, direct message. Reserve InMail budget for senior or hard-to-reach candidates.
Many developers and engineers list a work or personal email on their GitHub profile or in repository README files. GitHub profiles are publicly available and searching them is a legitimate sourcing method. Useful for technical roles.
Designers, freelancers, and senior professionals often have personal websites with contact forms or direct email addresses. Google “[Name] portfolio” or “[Name] [City] developer”.
Enter the candidate’s current employer domain and Hunter shows the email pattern ([email protected]). Combine with the candidate’s name to infer their likely work email. Use BounceZero to verify before sending.
Professional contact databases that include direct-dial and email for many professionals. Coverage varies by industry and seniority. Run exports through BounceZero before adding to recruitment sequences.
Searching a person’s name + email site operator across public forums, open-source project commits, and conference speaker pages can surface publicly listed email addresses. Time-intensive but high accuracy for specific targets.
Hi {{FirstName}},
I came across your work on [specific project or GitHub repo / recent article / conference talk] and wanted to reach out directly.
We’re building [short description of what the company does - 1 sentence] and have a [Job Title] role that I think would be a strong fit based on your background in [specific skill].
I’m not going to oversell it - here are the key facts:
- [Comp range or equity info]
- [Stack or tech detail]
- [Remote / hybrid / location]
- [Stage: Series A / bootstrapped / etc.]
Would it be worth a 20-minute call this week to see if there’s a fit? No obligation - I’d rather be direct than waste your time.
[Your Name]
[Title], [Company]
[Phone] | [Email]
Unsubscribe: reply “not interested” and I won’t reach out again.
Hi {{FirstName}},
Following up on my email from earlier this week in case it got lost.
I know you’re likely getting inbound at the moment - if this isn’t the right time or the role isn’t a fit, just reply with a “not now” and I’ll leave you alone.
If there’s any interest at all, happy to send over a 1-page role brief with the comp structure before asking for any of your time.
[Your Name]
Cold email sourcing to candidates is legal. Requirements: (1) Include a physical mailing address, (2) Include an opt-out mechanism, (3) No deceptive subject lines. No prior consent required for commercial email to individuals.
Processing candidate email addresses requires a legal basis. Most EU/UK recruiting firms use legitimate interest - documenting that the candidate is a plausible fit for the specific role. Always include: the right to object, a clear identity of the data controller, and an easy opt-out. Store a consent/legitimate-interest record for each candidate contacted.
In the US, cold email to candidates is legal under CAN-SPAM with standard requirements (physical address, opt-out, no deceptive subject lines). In the EU and UK, GDPR applies to candidate data - most recruiters use legitimate interest as the legal basis, documented per candidate, with an easy opt-out in every email.
Recruiter cold email typically achieves 35-55% open rates - significantly higher than sales cold email (25-45%). Reply rates are typically 8-18% for well-targeted outreach to passive candidates.
Primary sources: LinkedIn (InMail or direct message), GitHub profiles (many list work email), Hunter.io domain search (infer work email from employer domain), Apollo.io or Lusha for professional contact data. Always verify with BounceZero before sequencing - bouncing on candidate outreach is a brand risk.
A bounced email on a candidate is a brand signal. BounceZero verifies sourced emails before they hit your sequencer - protecting your domain and your employer brand. 100 free credits on every account.
Deep-dive guides on how email verification and inbox placement work
272,446-domain census: DMARC gap, provider divide, catch-all rates
10.2M verifications: 12.3% of addresses are dead, and where they hide
826K re-verifications: only 19% of valid addresses survive 90 days
True catch-all is 1.4% - most of what looks catch-all is unprobeable providers
info@ bounces 4.5x more than personal addresses - measured, not guessed
The 3x invalid-rate gap that vanishes when you control for domain size
Explore other topics