How agencies answer "how did you get my email?" replies without risking the client's domain
Every agency that runs cold outbound for clients eventually sees this reply land in the shared inbox: "How did you get my email?" Sometimes it is curious. Sometimes it is annoyed. Once in a while it is the first line of a complaint someone is writing up.
What makes it awkward for an agency is that the person answering usually did not source the contact. The list came from an enrichment step weeks ago, the copy went out from the client's domain, and the rep on reply duty is now speaking for a client they may not know well. If the answer is vague, defensive, or wrong, it is the client's name on it.
This is how to handle the question the same way across every client workspace.
Read the question before you answer it
BetterEnrich's write-up on this reply lists several motives behind it: plain curiosity, privacy awareness, a buyer checking whether you are legitimate, real annoyance, and occasionally someone documenting a complaint. Its point is that one honest, professional answer works for all of them. You do not need five scripts. You need one approach and a short escalation rule.
The tone differs by motive, but the facts in the answer do not. So the work is mostly upstream: making sure the rep can state the true source in one sentence without digging.
Answer in three moves
The guides we read agree on the shape of a good reply, and they agree it should be short.
- Say where the address came from, plainly. Real Good GTM's reply catalog puts it as "where, in one clause, then the exit," and lists "explaining your data stack" and "getting defensive" as the two ways it goes wrong. FirstSales says the same: be transparent and brief about the source, then de-escalate.
- Say why this person, in one line. LeadHaste's prompt guidance asks for one sentence on the specific trigger or fit signal, not "you seemed like a good fit." If the rep cannot name the reason, that is a targeting problem, not a copy problem.
- Offer the exit and mean it. "If this isn't relevant, say the word and you won't hear from us again." Then do it right away.
A version an agency rep can adapt:
Fair question. Your work email came from [source, e.g. your company's team page / a business contact database we use]. I reached out because [specific trigger tied to their company]. If this isn't useful, just say so and I'll take you off the list today.
No pitch. No second ask. Real Good GTM's broader rule for cold replies applies here too: answer the thing they asked in the first line and cost them one decision, not four.
What never goes in the answer
BetterEnrich's list of mistakes is worth printing for the reply team:
- Inventing a warmer source. Claiming a mutual connection referred you, or that you saw their post, when neither is true. It wrecks trust and can count as a deceptive practice.
- Blaming the norm. "This is standard business practice" reads as dismissive.
- Pitching past the question. Replying with the next sales step while ignoring the data question is a fast way to earn a complaint.
- Over-explaining. Nobody asked how many providers sit in the enrichment waterfall. "A business contact database" is a complete answer.
For agencies there is one more: never name another client, and never reuse a sourcing explanation written for a different client's list. The answer has to be true for this contact in this workspace.
Make the source answerable before anyone asks
The reply is only honest if the rep can see where the field came from. That is a data problem you solve at collection time, not in the inbox.
In practice that means every contact record in the client workspace carries the source of the email address and the date it was collected, and the reason the contact entered the campaign. If the rep has to message the ops lead to find out where a list came from, the reply will be late or vague, and late or vague is how a curious question turns into an irritated one.
For prospects in the EU or UK, this is more than courtesy. Article 14 of the GDPR covers personal data not obtained from the data subject, and it includes telling the person "from which source the personal data originate, and if applicable, whether it came from publicly accessible sources," at the latest at the time of the first communication when the data is used to contact them. Your client's counsel decides how that applies to their outbound. Your job as the agency is to make sure the source is on record and retrievable per contact.
Route the formal versions out of the shared inbox
Most of these replies are informal and the rep can close them. Some are not. BetterEnrich's escalation split is a good default:
- A formal data subject access request goes to the client's compliance or legal contact, not a sales rep.
- A threat to file a regulatory complaint goes to the account lead and the client.
- A question about a specific source the rep cannot answer goes to whoever owns the data step.
Write those routes into each client's reply playbook during onboarding, with names. A rep on reply duty at 4:45 on a Friday should not be deciding what counts as a legal request.
Suppress first, then reply
If the person wants out, the removal happens before the reply goes back, not at the next weekly list cleanup. The FTC's CAN-SPAM guide says opt-outs must be honored within 10 business days and that you cannot make the recipient take any step beyond sending a reply email or visiting a single web page. Real Good GTM's advice on prose opt-outs is blunt: suppress it yourself, then send nothing or one line. Do not send them an unsubscribe link and ask them to click it.
The CAN-SPAM guide also says you cannot contract away responsibility when someone else sends on your behalf. Both the company being promoted and the company sending can be held responsible. For an agency, that means the client is exposed by how your team handles this reply, which is a good reason to treat it as a process and not a judgment call.
Track it like a signal
Log every "how did you get my email" reply with the campaign and the source of the address. Review them weekly per client. BetterEnrich suggests watching whether these inquiries are rising, clustered in a region, or tied to one campaign. A spike usually means targeting drifted, a list source is weak, or the first line reads like it came from nowhere. Prospects who see an obvious reason for the email ask this question less.
Where GTM fits
GTM runs find, qualify, write, send, reply, and book inside isolated client workspaces. Every field carries provenance, retention is anchored to the date the data was collected, and suppression survives a data purge. That is what lets a rep answer "how did you get my email?" with one true sentence and act on the opt-out in the same sitting. GTM's data model is built to GDPR and the product runs US-only today.
If you run outbound for several clients and want source trails your reply team can actually read, join the waitlist.
Sources
- BetterEnrich, "How to respond when a prospect asks where you got their information": https://blog.betterenrich.com/respond-when-prospect-asks-where-got-information
- Real Good GTM, "How to answer every cold email reply": https://www.realgoodgtm.com/blog/cold-email-reply-types
- FirstSales, "Cold email objection handling: copyable reply templates": https://firstsales.io/blog/cold-email-objection-handling-templates/
- LeadHaste, "'How did you get my email?' reply prompt": https://leadhaste.com/prompts/reply-to-how-did-you-get-my-email
- GDPR Article 14 (gdpr-info.eu): https://gdpr-info.eu/art-14-gdpr/
- FTC, "CAN-SPAM Act: A Compliance Guide for Business": https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business