MailCamp New-Business

MailCamp wanted a new-business motion aimed at prospects who weren't customers yet, which meant starting from a plain list of roughly 4,800 Dutch B2B companies and almost nothing else: no read on who already used an email platform, who didn't, or which message would land where.

The message depends entirely on that answer. Pitch "start emailing your list" to a company that has been sending campaigns through HubSpot for years and you've announced you didn't do your homework before saying anything else. The obvious fix is a paid tool that reads a company's tech stack, but point that at 4,800 domains and the invoice scales with every row, whether or not that company ends up mattering for the campaign.

Read the answer for free before paying for anything: email platforms leave a fingerprint in a company's public DNS records. Match against those first, split the list into tool-known and tool-unknown, and only send the unresolved residue to a paid lookup, capped.

I started with a list of about 4,800 Dutch B2B companies and one blunt question: how do you write a cold email to a company when you don't know if they already use an email platform. Get that wrong and the first line tells the reader you didn't check.

The obvious first move is a paid tool that reads a company's tech stack. Point one of those at 4,800 domains and the bill scales with every single row, whether or not that company turns out to matter for the campaign. So before touching anything paid, I asked what you could learn about a company's email setup for free.

Turns out, quite a lot. Any company sending email at scale has to publish DNS records that authorize which servers may send on its behalf: SPF, often DKIM, and MX entries that point straight at the platform doing the sending. Mailchimp, HubSpot, Klaviyo, Spotler, ActiveCampaign, and dozens more all leave a fingerprint sitting in public DNS that anyone can query, for free, before spending a cent.

So I built a fingerprint matcher against dozens of known email-tool signatures and ran it as the first pass across the whole list, before any paid step existed in the pipeline at all.

It didn't resolve everyone. Some companies send through custom domains or setups where the DNS trail is too thin to call with confidence, and that's the part I didn't want to guess on: better to spend a little on the unresolved slice than send a confident migration pitch to a company that has nothing to migrate from. So I hard-capped the paid fallback to that leftover residue only, instead of letting it quietly creep back to covering the whole list "just in case."

That cap is what makes the economics hold. The free DNS pass does the sorting for the bulk of the list, and the paid step only ever answers for what's left after that, up to a fixed ceiling.

Where it landed: the list now sorts itself before a single message goes out. Every company arrives already classified as either "has a tool, here's the migration or cost angle" or "no tool detected, here's the owned-audience angle," and the paid step only ever has to answer for the companies the free pass genuinely couldn't place.