How to Build a Lead List From Public Records Without Guesswork

Stop looking up the same half-finished business records. Build a B2B research queue from permitted public sources and open-source tools that a person can review.

Editorial gouache illustration: A researcher compares three open unlettered books and a simple laptop screen at a public library reading desk

The short answer

Start with the business information your team is missing. Collect only records you're permitted to collect, keep the source and collection date, and keep observed facts separate from guessed contact matches. A domain or mail-server check doesn't prove who someone is or that you may contact them. Have a person review uncertain matches and the outreach rules before you export anything.

  1. Keep the source and date next to each field.
  2. Keep company matching separate from guesses about individual contacts.
  3. Permission to collect and permission to contact are two different checks.

Check the gaps in existing contact data

If your team keeps looking up the same company because its record is incomplete, more data may just give them more to check. Commercial contact databases often include old phone numbers, bounced email addresses and a subscription fee that never stops.

Pull a small sample of the records your staff actually use. Work out which missing fields block real work and which just look interesting. Note where each existing value came from and whether anyone checked it. A research project should answer a defined question, like which companies offer a relevant service, not collect every personal detail available. Decide what a finished record looks like before you add more sources.

  1. Contact records
  2. Check currency and source
  3. Flag records for review

Choose permitted public records

A custom research workflow can collect permitted records from public government registries, subject to each source's terms and the law that applies. Read the terms, access method and restrictions for every source before you collect from it. Use an authorized export or documented API when one exists. RFC 9309 defines the crawler directives in robots.txt and says plainly that they are not access authorization. Following robots.txt doesn't give you permission to collect or reuse everything. Keep the source URL, retrieval date and allowed purpose with the research so a reviewer can see why a record is there.

  1. Public registries
  2. Review source terms
  3. Collect permitted records

Separate technical checks from verified contacts

Permitted collection can give you company names, public addresses and source URLs. Domain and MX checks tell you about the technical setup. They don't verify a person's identity, role or consent, and they don't prove an individual address will deliver. Record only the technical fact you tested. A domain with mail records can still have a wrong individual address, and a company website may list several unrelated locations.

Keep the original organization name, the cleaned-up name and the reason you think two records match. Similar names go to a review queue. Don't guess a personal email address and mark it verified because the format looks right.

  1. Domain and MX checks
  2. Technical signals
  3. Identity still unverified

Create a sourced review queue

The workflow produces a review queue of organizations, domains and contact guesses, each with source links, a validation status and the rules for lawful outreach. Show the observed value, the source passage or record, the proposed cleanup and any open questions together. Let the reviewer accept fields one at a time instead of approving a whole profile at once. If a source changes later, flag the conflict instead of quietly overwriting a value someone already reviewed. When you export to a CRM, carry over suppressions and corrections so a refresh doesn't bring back a contact someone deliberately removed.

  1. Source links
  2. Validation status
  3. Human review queue

An illustrative workflow

A public registry lists a company whose name looks like a prospect already in the CRM. The registered city is different, and the website describes another line of business. The workflow records both sources and leaves the match open. A reviewer decides they are two different companies and keeps the records apart. The research worked because it prevented a false merge. No guessed employee or email address became a verified contact.

Checks before using the workflow

Registries, websites and technical signals can be incomplete or out of date. A confidence score doesn't replace missing evidence about a person's role or whether you may contact them. Measure accepted fields, false matches and correction time. Before you send email, read the FTC's CAN-SPAM guidance and the rules that apply to your audience.

Judge the cost per accepted, useful record. Count source charges, collection tools, review, false-match fixes and maintenance. Less repeated lookup can give your sales team more time for real conversations, but research capacity doesn't guarantee new business. Keep the expected cost saving separate from any sales or margin benefit you haven't measured yet.

  • Each collected field has a source and a collection date.
  • Someone approved the collection method and the intended use.
  • Company matches and contact guesses are kept apart from verified facts.
  • Exports keep corrections, exclusions and review status.

Sources and further reading

  1. IETF: Robots Exclusion Protocol, RFC 9309
  2. FTC: CAN-SPAM compliance guide

Written by Great Lakes Computing Office

We help businesses in Toledo and Detroit Metro plan and implement useful software and AI workflows. Meet the office.

Make this useful for my team.

Bring us a task you spend too much time on. We can look at where the time goes, what AI could handle, and whether the benefit would cover the cost. We reply within one business day.

Request a call