IT services lead generation is finding and qualifying businesses that buy managed services, support, cloud migration, security and consulting, usually SMBs and mid-market firms without a full IT team, and reaching the owner, finance lead or operations head who signs the contract. The data has a quirk: IT-literate targets run their own mail, and self-hosted domains behave unlike hosted ones. In the BounceZero corpus, .net addresses ran 17.7% invalid and 28.8% unconfirmed, against 59.7% confirmed valid on .com.
Firms of 10 to 100 staff with no IT department. The owner or finance director signs; an office manager raises the ticket. Company domain, often on hosted Microsoft 365 or Google Workspace, sometimes still on an ISP or legacy host.
Firms of 100 to 1,000 with one or two IT staff who outsource what they cannot cover. The IT manager evaluates; finance signs. Company domain behind a gateway, so unconfirmed results are common.
Clinics, law firms, accountants, schools and manufacturers that buy IT services with compliance attached. The vertical guides on this site cover each one's domain behaviour; the IT services pitch rides on the compliance need.
Technology detection is the sector-specific source: what a company runs is visible from its DNS, mail headers and website, and that is the trigger for most IT services pitches.
| Source | What it gives you | Address quality | Trigger it supplies |
|---|---|---|---|
| Technology and DNS detection (BuiltWith, Wappalyzer-style tools, MX and SPF lookups) | Mail platform, hosting, CRM, security stack per domain | None; account-level | Legacy mail, missing DMARC, end-of-life software |
| Company registers and local directories | Firms by size, sector, region | Role addresses | Account list for a territory |
| Vendor partner directories (Microsoft, Google, Cisco partner finders) | Competitors and partners | Role addresses | Who already has a provider |
| LinkedIn plus a finder | Owners, finance and IT managers | 65 to 85% accuracy; 10 to 25% invalid at export | Job changes and hiring |
| Job postings | Firms hiring IT staff or posting IT projects | Named hiring managers at larger firms | Capacity gap right now |
| Referrals from existing clients and vendors | Warm introductions | High | The best lead an MSP gets |
Finder mechanics: Email finder guide. Enrichment vendors for the detection layer: data enrichment tools.
IT-literate targets run their own mail more often than other SMBs, and self-hosted mail is where strange results come from. BounceZero corpus, April to October 2026.
| Domain type | Corpus segment | Invalid | Catch-all | Unknown | Confirmed valid |
|---|---|---|---|---|---|
| Company domains on .com | .com | 16.4% | 4.4% | 14.7% | 59.7% |
| Company domains on .net | .net | 17.7% | 0.6% | 28.8% | 19.9% |
| Company domains on .co | .co | 17.1% | 25.6% | 15.3% | 38.7% |
| UK firms | .uk | 17.0% | 3.7% | 10.6% | 65.0% |
| All non-freemail domains (business and ISP) | Business | 14.5% | 2.3% | 27.0% | 32.6% |
| Owners on freemail | Freemail | 17.6% | 1.1% | 2.1% | 74.0% |
The .net row shows self-hosted and legacy mail at work: a high unconfirmed share and under 20% confirmed. The .co row shows the opposite failure, catch-all on a quarter of addresses. Full cuts: Lead List Quality Benchmarks 2026.
For an IT services seller, the verifier's output is lead intelligence as well as hygiene. A company whose addresses return unknown from a self-hosted server, or whose domain is catch-all with no filtering, or whose MX points at a legacy host, is telling you something about its IT. A domain on Microsoft 365 with DMARC enforced is a different prospect from one on a decade-old on-premise server.
That turns the list into two segments with two pitches. Confirmed addresses on modern hosted mail get the managed-services and security message. Unconfirmed addresses on legacy or self-hosted mail get a phone call, because the email may not arrive, and the call opens with what you saw.
Company register plus size band plus sector. A few hundred firms within the service radius or the vertical focus.
MX, SPF, DMARC, hosting, website platform. Record the mail platform; it drives the segment and the channel.
Owner or finance lead, plus office or IT manager, from LinkedIn and a finder.
A bulk job, then a pivot by result and mail platform. Confirmed on hosted mail to email; unknown on legacy mail to phone with the finding as the opener.
The missing DMARC record, the end-of-life server, the job posting. Specific beats generic in this sector by a wide margin.
Stacks change and people move. Both are triggers for a fresh touch.
Clinics, law firms, accountants and schools all buy IT services with a compliance driver attached, and each has its own domain behaviour described on its vertical page. An MSP that picks one of those verticals gets a sharper list, a trigger that writes the first line, and a verification profile it can plan around, instead of a general SMB list with every failure mode mixed in.
Types, sources, qualification
Technology detection and enrichment vendors
The outbound engine, step by step
Collect, verify, segment
The .net, .co and .com rows in full
A vertical with compliance-driven IT spend
Referrals first, then an outbound engine: a territory account list from company registers, technology detection per domain for the trigger, two named contacts per firm, verification before sending, and a sequence that opens with the specific finding. Vertical focus (clinics, law firms, accountants) sharpens both the list and the message.
In the 2026 corpus .net addresses ran 17.7% invalid and 28.8% unconfirmed, with under 20% confirmed valid, because many .net domains are self-hosted or on legacy mail that refuses or mishandles verification probes. For an IT services seller that result is a signal: the prospect's mail setup is itself a reason to call.
A visible gap: a missing or unenforced DMARC record, mail still on a legacy host, an end-of-life server or CMS, a job posting for IT staff, or a compliance deadline in the prospect's vertical. Technology detection tools and DNS lookups surface these before any contact is made.
Email the confirmed addresses on modern hosted mail with the trigger in the first line. Call the owners whose addresses came back unknown from legacy or self-hosted mail, because the email may not arrive and the finding makes a natural opener. Both routes come from the same verification pivot.
A company is a business contact, so legitimate-interest email with a named source and an opt-out applies in the UK and EU, and CAN-SPAM in the US. Phone calls in the UK must respect the Telephone Preference Service and the Corporate TPS; in the US, state do-not-call rules apply to some business lines. This is a working summary, not legal advice.
Upload the territory list, get valid, invalid, catch-all and unknown per row, and open with what the mail setup told you. 100 free checks a month, unknowns refunded.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Where leads come from in each vertical, with the corpus rates for its domains
Accountants email lists for software and service sellers
Law firm lead generation for legal-tech and service sellers
Lead generation for marketing agencies winning their own clients
Logistics leads for B2B sellers
Building or buying a recruiters email address list? Where recruiter contacts live (agency domains,...
Lead generation for startups in 2026
Continue through related topics