How to Cold Email Companies Already Using a Competitor

Zendesk's case studies link to 235 customer websites. The websites gave Zendesk away on 41. Their DNS records gave it away on 183.

To cold email a competitor's customers, find them in DNS records and competitor-hosted pages, re-check each name the month you send, email two to four months before renewal, and pitch their problem, never the rival's flaws.

Most guides stop at "use tech-stack data." They skip two questions. Where does the list come from, and is it still true? I measured both for Zendesk, a big help desk that leaves lots of public traces. Nothing here is a knock on Zendesk.

The best free list of a competitor's customers isn't on their websites. It's in their DNS records and on the pages the competitor hosts for them. And any tech-stack list you buy is partly out of date. For Zendesk, about one tagged company in five has moved on. For Drift, which is being shut down, nine tags in ten no longer check out.

Why go after a competitor's customers at all?

A competitor's customer has already admitted the problem exists, found budget and picked a category. You're selling a better version of a decision they already made.

They also switch more than you'd think. In G2's 2025 Buyer Behavior Report, a survey of 1,169 B2B buyers, 32% of companies under 250 employees and 49.5% of those with 1,000 to 5,000 had switched providers in the past year to get better AI features. A Capterra survey of over 3,500 businesses found 59% regretted a software purchase from the previous 18 months. And Vertice, which tracks over $75 billion of software spend, measured SaaS prices up 16.4% year over year in June 2026, a new high.

The catch is that these buyers are easy to annoy. Get the facts wrong or sneer at their choice, and you've lost them.

Where can you find companies that use a competitor?

I tried every free way I could find to list Zendesk users, plus the tech-stack tags in our own database, and checked everything on October 8, 2026.

Competitor-hosted pages make the biggest free list. Zendesk hosts help centers at company.zendesk.com, and the subdomain is usually just the company's name. Common Crawl, a free public archive of the web, saw at least 8,837 of those subdomains in one monthly crawl. I checked 200 at random, and 163 are live accounts today. That's roughly 7,000 live Zendesk accounts from one free public index, more than every other method here put together. If your competitor hosts pages for its customers, like many help desks, job boards and status pages do, start there.

Case studies are quick but narrow. One sitemap download gave me 235 named companies, and four in five still show Zendesk. But Zendesk picked them to show off, so they may not look like your buyers.

Job posts are current but noisy. I read every Zendesk mention in posts from the free Himalayas, Arbeitnow and RemoteOK APIs. The posts ran from late July to early October 2026, and most were remote jobs. Of 40 mentions, 24 listed it as an example, like "Zendesk, Freshdesk or similar," and 7 came from recruiters or outsourcers. Only 9 posts, from 8 companies, showed real use. Sales tools did better. Of 16 posts naming Gong, a call-recording tool, 10 described the company's own stack. Gong never showed up in my DNS or website scan, so for tools like it, job posts are the main free signal.

Marketplace reviews name names. Every Shopify App Store review shows the store's name, country and how long it has used the app. Zendesk's 94 reviews are mostly years old, while Klaviyo, an email tool popular with Shopify stores, has 3,362.

Review sites give you words, not names. G2's community guidelines let reviewers hide who they are. Read the reviews by hand for the exact complaints, and borrow those words.

Why do DNS records find more than a website scan?

DNS is the public address book for a company's domain. Lots of business software only works after the company adds a record there, and anyone can look it up. MITRE, which catalogs hacking techniques, notes that DNS records "may also reveal the use of third party cloud and SaaS providers," and it names Zendesk as an example.

Four kinds of records give tools away:

• SPF, the list of services allowed to send email as @company.com. A help desk that sends replies from [email protected] shows up here.
• DKIM keys, which a vendor asks you to publish so the emails it sends for you pass spam checks. They sit at addresses like zendesk1._domainkey.company.com.
• Verification codes that vendors like DocuSign, Atlassian and Zoom ask you to add to prove you own the domain.
• Subdomains like help.company.com that point straight at the vendor.

A website scan, like the Wappalyzer browser extension, reads the code on a company's homepage. It catches chat widgets, analytics and booking links, and misses tools that live behind a login. I checked 2,000 random B2B companies with 11 to 1,000 employees both ways.

Source: Ken scan of public DNS records and homepage code, October 8, 2026. n = 1,988 B2B company domains (11-1,000 employees) sampled at random from Ken's company database. Bars split the companies where each tool turned up; counts on the right.

Zendesk turned up at 101 of them, and 85 showed it only in DNS. Among Zendesk's 235 case-study companies, the website gave it away on 41, or 17%. Counting only the 191 sites my scanner could load, that's still just 21%. DNS found it on 183, or 78%. Of those 183, SPF caught 132, DKIM keys 127 and help-center subdomains 89, with lots of overlap.

To check one company without code, paste the domain into Google Admin Toolbox Dig or the MXToolbox SPF lookup and look for these patterns from my scan:

One warning. Companies forget to delete DNS records when they leave a vendor. A record proves someone set the tool up once, not that they pay for it today.

How accurate are tech-stack lists?

Less accurate than the sales page suggests. A tag is a snapshot, and you rarely know when it was taken.

I took 300 companies tagged with each of seven tools in our database, where the tags come from data providers, and re-checked each one with the same scan.

Source: tech-stack tags in Ken's company database, records last updated August 2025 to October 2026, re-checked with a public DNS and website scan on October 8, 2026. n = 300 companies per tool (299 for Intercom and Marketo). Whiskers show 95% Wilson confidence intervals.

Drift is the extreme case. In August 2025, attackers used stolen Drift tokens to pull data out of companies' Salesforce accounts, and Google's threat team said it knew of over 700 potentially affected organizations. In March 2026, Clari + Salesloft, which owns Drift, announced a gradual sunset. Of 300 companies our tags still call Drift users, 23 still load it.

Tools still on the market hold up better, but not by enough. Of tagged Zendesk users, 64% still show it. The scan misses some real users, since even on Zendesk's showcased customers it finds Zendesk only 81% of the time. So 64% out of a possible 81% means roughly one tagged company in five has moved on. Check only websites and you'd confirm just 22 of the 266 tagged Zendesk companies whose sites loaded, or 8%.

A recent "last updated" date doesn't save you either. Records updated in 2026 held up no better than records last touched in 2025, 52% against 55% across all seven tools. The date tells you when something in the record changed, not when anyone re-checked the tag.

So here's my rule. A tech-stack list is a rumor until you've checked it this month. Re-check every company within 30 days of emailing it, and drop the ones with no current signal. They may still be good prospects. They just aren't competitor customers.

When is the best time to email a competitor's customer?

Before they decide to renew, which is earlier than you'd think. Many SaaS contracts renew on their own. Under section 7.2 of Zendesk's customer agreement, the subscription renews for the same term, Zendesk "may apply then-current rates," and stopping it takes at least 30 days' written notice unless the order form says otherwise. Zylo, which tracks software renewals, says 30, 60 and 90-day notice periods are the most common. So the real decision happens one to three months out, and an email in renewal week is too late.

Nobody publishes their renewal date, but three things hint at the month:

• The date of the case study or press release about going live.
• The first Wayback Machine snapshot where the vendor's widget appears on their site.
• A job post about "implementing" or "migrating to" the tool.

An annual contract renews on the anniversary of its start date, which is usually close to go-live. I'd email two to four months before it.

Other moments work too. A price hike is one, like Salesforce's 6% average list-price rise for Enterprise and Unlimited editions in August 2025. So is a product being retired, like Drift. A new head of support or sales ops reviews every tool early, which our post on job-change outreach covers, and signal-based outbound shows how to stack these moments.

I'd skip the day of an outage or security incident. Everyone emails that day, and it reads like ambulance chasing. Write a few weeks later about the problem it exposed.

How do you write the email without trashing the competitor?

Match your sentence to your evidence.

Never say how you know. "I saw mail.zendesk.com in your SPF record" is accurate, and it's creepy. Keep the competitor's name out of the subject line too, or it reads like an attack ad.

Then talk about their problem, not the competitor's flaws. People defend choices they made. A 1993 study in Marketing Letters found that negative comparative ads triggered more counterarguing and lower acceptance of the ad's claims than positive ones. Naming a rival is generally fine. The FTC's policy on comparative advertising encourages it when the comparison is clear and not deceptive, and the EU's comparative advertising directive rules out comparisons that "discredit or denigrate" a competitor. This is general information, not legal advice.

Here's the shape I'd use. Fill the brackets with facts you can prove.

Subject: support costs at renewal

Hi Dana,

Are you still running support on Zendesk? If so, one question. When the seat bill resets at renewal, does it still fit a team your size?

We help [type of team] get [one outcome, with a number you can back up]. Switching usually takes [honest time frame].

Worth a 2-minute comparison before your next renewal? If you've already moved, ignore this.

Notice there's no "clunky" or "outdated" in there. If that's true for them, they already know.

At Ken, we run cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own, and a human approves every campaign before the first email goes out. If your list needs an ICP filter on top of the competitor filter, our guide to building a lead list with buying signals picks up from here.

Frequently asked questions

Is it legal to cold email a competitor's customers?

In the US, B2B cold email is generally legal if you follow the CAN-SPAM rules, which make no exception for business email. That means an honest sender and subject line, a postal address and a working opt-out. The EU, UK and Canada have stricter consent rules, covered in our post on cold email opt-out rules. This is general information, not legal advice.

Is it okay to look up a company's DNS records?

Yes. DNS records are public by design, and mail servers read them every time an email arrives. Just don't quote the record back in your email.

Are paid tools like BuiltWith better than free methods?

They cover far more domains than you can check by hand, but they can't promise a tag is current. I didn't test BuiltWith itself, but the provider tags in our database held up only 44% to 75% of the time for tools still on the market. Use paid data to build the list, then verify it.

What if they just signed a multi-year contract?

Don't pitch a switch. Note the end date, send something useful in the meantime, and come back two to four months before it ends.

The short version

Find customers where the competitor's own setup leaves traces, re-check every name the month you send, and email before the renewal decision. Then write about their problem and let them judge the competitor themselves.

If you'd rather have us build it, the first campaign is free at ken.so/free-campaign.