How to Find Someone’s Email Address (6 Reliable Methods)

Finding someone’s email address is one of the first skills any sales or partnerships team has to nail. Most of the time, the email exists somewhere public. You just need the right method to surface it. The six approaches below cover everything from official sources to email finders, plus the verification step you should never skip.

Before you start: work email vs personal email

Before you start digging, separate work emails from personal ones. A work email like firstname.lastname@company.com is tied to the recipient’s role and is reachable in a business context. A personal email lives outside that context and is protected by privacy expectations. The only legitimate way to use one is with explicit consent.

The rest of this guide focuses on work emails, the kind you actually need for credible B2B outreach.

Ground rules: relevance, transparency, opt-out. Solid cold email starts with three rules. Stay relevant: you are reaching out because of the person’s job, not because you bought a list. Be transparent about who you are, what you want, and why you are emailing this specific person. Always include an opt-out. These habits protect the recipient’s data, keep you on the right side of the law, and build trust over time.

Method 1: find the email at the source on official channels

Company website: Contact, About, Team, Legal pages. The fastest way to find a work email is to look on the company’s own site. Start with the “Contact” or “Get in Touch” page. Then check the “About Us” section, which often lists key roles. The “Team” page sometimes has direct emails for each member. Do not skip “Legal” or “Terms of Service” pages, which usually show admin or legal contacts. Finally, scan the footer.

Public documents: press releases, PDFs, job ads, events. Public documents are an underrated source. Press releases almost always include a press contact. Job postings on the careers page often mention the recruiter or hiring manager’s email. Event pages (webinars, conferences, trade shows) usually list organizers with their work emails. These documents exist precisely to make the relevant person reachable, which means the emails are usually live and current.

Contact form: how to use it to surface the right email. If a direct address is nowhere to be found, the contact form can still get you to the right person. State clearly who you want to reach, name the team or function, and explain why in one or two short sentences. A specific request gets routed faster than a vague one. You will often get a reply directly from the person you are looking for, with their actual email in the signature.

Method 2: identify the company’s email domain

Once you have the company, identify the main domain used for emails. This is the foundation of every email-finding method downstream. Larger groups often run multiple domains: a corporate one, brand-specific ones, and sometimes subsidiary domains. Each can have its own email pattern.

Tools like Hunter or Minelead help here: they crawl websites, social profiles, and job ads to surface the domains a company actively uses for email.

Watch out for: different domains, aliases, subdomains. A few common traps. The website domain is not always the email domain: a company might use www.brand.fr for its site but contact@company.com for email. Rebrands or restructures can move email to a new domain while leaving the old site URL in place. Aliases and subdomains add another layer of confusion. A domain search tool like Hunter’s Domain Search surfaces these variants and saves you from sending to a domain that no one reads.

Method 3: deduce the address using the company’s email pattern

Once you have the domain, you can often deduce someone’s address from the company’s standard pattern. Common formats:

• firstname.lastname@domain.com (the most widespread)
• f.lastname@domain.com (first initial + last name)
• firstname@domain.com
• lastname.firstname@domain.com

These patterns show up in email signatures, press releases, and any document where a company employee is reachable.

How to confirm the pattern without guessing. Look for one or two public emails from the same company. They are usually visible in press releases, signatures on the team page, or PDFs like job ads or whitepapers. Two confirmed examples are enough to lock in the pattern. Combined with an email finder, this method beats blind guessing by a wide margin.

Method 4: use Google with smart search operators

Google is still one of the strongest tools to find a public work email. Search operators turn billions of indexed pages into a directory of professional addresses that have been published openly.

A few queries to try:

• "firstname lastname" "@company.com" — associates a name with a known domain
• "firstname lastname" company filetype:pdf — digs into PDFs that often contain contact info
• intext:"@domain.com" -site:domain.com — surfaces emails published outside the company’s own site
• intitle:"contact" "team" domain.com — targets pages with contact details

Find email occurrences on a specific domain. Google indexes pages from conference bios, press kits, team pages, and job posts. To narrow your search: site:company.com "@company.com". Check the cached version if the email was recently removed.

Whatever you find this way, run it through an SMTP verification before sending. A public email is not always an active one.

Method 5: use LinkedIn and social media to surface the contact

Identify the right person (role, seniority, scope). Start by narrowing your LinkedIn search to the exact person you want. Use the right job title, the right seniority, and the right region or sector. That filtering kills the homonym problem and prevents you from reaching out to someone with the same name in a different role. Sales Navigator filters help: cross-reference company, location, and job-related keywords.

Check visible contact info, then go direct. Open the “Contact info” section of the profile to see whether an email or phone number is publicly shared. Roughly one in ten LinkedIn users surfaces these details. If nothing is public, send a short and respectful direct message asking for it. Avoid scraping: it violates LinkedIn’s terms of service.

Creators and experts: emails often visible in bios and content. Creators, founders, and subject-matter experts often publish their email in their LinkedIn bio, in posts, or in newsletter footers. Watch out for obfuscated formats like “firstname at domain.com” and translate them back to a real address.

Method 6: use an email finder (when you have name + company)

When it makes sense: B2B, volume, time saved. Email finders earn their place when you already have a name and a company and want the email in seconds. They generate the most likely work address and run a verification check on top. They are the right move when you are working through a list of leads or scaling outbound. The best ones publish hit rates above 90% and refresh their databases daily.

How to choose a tool: coverage, verification, freshness, export. When you compare email finders, look at four things: coverage (large databases of 200M+ B2B contacts increase the odds of a hit on niche profiles), verification (multi-step checks including SMTP validation), freshness (data refreshed daily, not quarterly), and export (smooth CSV and CRM integrations). Hunter is strong for domain-level searches, Dropcontact differentiates on GDPR-clean enrichment, Apollo is built for high-volume outbound.

Bulk vs single lookups: do not burn your domain by sending too fast. If you are working with a list, bulk enrichment via CSV is the right tool. But ramp up gradually: start with batches of 10 to 50 leads to test deliverability before scaling. Pace your sending (a common rule is 50 emails per day per domain when warming up) to protect your sender reputation.

The non-negotiable step: verify the address before sending

Why verification matters: bounces, sender reputation, deliverability. Verification is the gate between “I have an email” and “I should send to it.” It catches hard bounces, the permanent rejects from addresses that do not exist. Once your bounce rate climbs above 5%, mailbox providers start treating you as a low-trust sender. That is enough to drop your reputation across the board. The fix is upstream: clean your list before you send by checking syntax, domain existence, and SMTP response.

Handling uncertain cases: catch-all, high risk, duplicates. For catch-all domains (which accept every email, even non-existent ones), high-risk addresses, and duplicates, apply a strict rule: drop anything below a 90% confidence score. Sending to those addresses costs you more than it earns. If you really need to reach the person behind an uncertain address, switch channels: a targeted LinkedIn message, a call to the company’s main line, or a contact form.

What to do if you cannot find the email

Call the main line to get the right contact. A direct call to the company’s main number still works. Lead with a clear, specific ask: “Hi, could you give me the email address for the [function] lead? I am putting together something specifically for them.”

Ask for a warm intro through a shared contact. Use your network. LinkedIn shows shared connections at a glance. A warm intro converts at a much higher rate than a cold one because it inherits trust from the connector. Send a short message to your shared contact: “Could you intro me to [name]? I would like to talk with them about [specific value].”

Reach the right generic alias when one exists. When the company publishes generic aliases like info@domain.com or sales@domain.com, use them. They typically route to the right team and avoid the bounce risk of guessed addresses. Before you send, run an SMTP check on the alias to make sure it is actually monitored.

Common mistakes to avoid

Emailing a personal address without consent. Reaching out to a personal email without explicit consent risks GDPR complaints and an immediate spam-list flag. Personal addresses sit outside the professional context and were not given to you for outreach.

Guessing 10 addresses and emailing all of them. Sending the same message to multiple address variants triggers multiple hard bounces, which tank your sender reputation. It also annoys the prospect. Either way, your conversion odds drop to zero.

Not adapting the message to the person’s context. Generic copy gets deleted in seconds. Tie the email to the recipient’s actual situation: their role, a recent post they wrote, a hiring decision, a problem visible from outside. Lead with one specific benefit and end with a low-friction ask.

How Zeliq speeds up B2B email finding and activation

Zeliq’s contact database lets you target by job title, industry, and company size across 450M+ contacts. From there, you enrich the work email and direct phone number on demand. The combination of ICP targeting and waterfall enrichment across 40+ providers returns verified data: about 80% on emails and 60% on direct phones. That removes most of the manual lookup work and keeps your pipeline fed.

Enrichment and verification to cut bounces. Waterfall enrichment cross-references multiple providers and runs automatic verification, so the data you send into is clean. That cuts bounces, lifts deliverability, and catches risky cases like catch-all domains. Drop in a CSV or a LinkedIn list and the enrichment runs in seconds.

Switch to multichannel when email is not workable. If the email comes back unusable or the catch-all risk is too high, multichannel sequences let you switch to LinkedIn, calls, or follow-ups based on engagement signals, without overloading the same channel.