Finding someone’s email address is one of the first reps any sales or partnerships team has to nail. Most of the time, the email exists somewhere public, you just need the right method to surface it. The six approaches below cover everything from official sources to email finders, and the verification step you should never skip.
Before you start: work email vs personal email
Work email vs personal email: why it matters
Before you start digging, separate work emails from personal ones. A work email like firstname.lastname@company.com is tied to the recipient’s role and is typically reachable in a business context. A personal email lives outside that context and is protected by privacy expectations. The only legitimate way to use one is with explicit consent, which usually means asking for it directly.
The rest of this guide focuses on work emails, the kind you actually need for credible B2B outreach.
Ground rules: relevance, transparency, opt-out
Solid cold email starts with three rules. Stay relevant: you are reaching out to someone because of their job, not because you bought a list. Be transparent about who you are, what you want, and why you are emailing this specific person. Always include an opt-out, like a one-line unsubscribe option. These habits protect the recipient’s data, keep you on the right side of the law, and build trust over time.
Method 1: find the email “at the source” on official channels
Company website: Contact, About, Team, Legal pages
The fastest way to find a work email is to look on the company’s own site. Most companies publish at least a few addresses on their public pages.
Start with the “Contact” or “Get in Touch” page. Then check the “About Us” section, which often lists key roles. The “Team” or “Our Team” page sometimes has direct emails for each member.
Do not skip “Legal” or “Terms of Service” pages, which usually show admin or legal contacts. Finally, scan the footer: it often holds extra contact info or links to pages you missed.
Public documents: press releases, PDFs, job ads, events
Public documents are an underrated source. Press releases almost always include a press contact. Job postings on the careers page often mention the recruiter or hiring manager’s email. Event pages (webinars, conferences, trade shows) usually list organizers with their work emails.
These documents exist precisely to make the relevant person reachable, which means the emails are usually live and current.
Contact form: how to use it to surface the right email
If a direct address is nowhere to be found, the contact form can still get you to the right person. Use it strategically: state clearly who you want to reach, name the team or function, and explain why in one or two short sentences. A specific request gets routed faster than a vague one. You will often get a reply directly from the person you are looking for, with their actual email in the signature.
Method 2: identify the company’s email domain
Find the official site and the domain used for emails
Once you have the company, identify the main domain used for emails. This is the foundation of every email-finding method downstream. Larger groups often run multiple domains: a corporate one (group.com), brand-specific ones (brand1.com, brand2.com), and sometimes subsidiary domains. Each can have its own email pattern.
Tools like Hunter or Minelead help here: they crawl websites, social profiles, and job ads to surface the domains a company actively uses for email.
Watch out for: different domains, aliases, subdomains
A few common traps. The website domain is not always the email domain: a company might use www.brand.fr for its site but contact@company.com for email. Rebrands or restructures can move email to a new domain while leaving the old site URL in place. Aliases (redirects) and subdomains (sales.brand.com) add another layer of confusion.
A domain search tool, like Hunter’s Domain Search, surfaces these variants and saves you from sending to a domain that no one reads.
Method 3: deduce the address using the company’s email pattern
The most common patterns (firstname.lastname, f.lastname, firstname, etc.)
Once you have the domain, you can often deduce someone’s address from the company’s standard pattern. Common formats:
- firstname.lastname@domain.com (the most widespread)
- f.lastname@domain.com (first initial + last name)
- firstname@domain.com
- lastname.firstname@domain.com
These patterns show up in email signatures, press releases, and any document where a company employee is reachable.
How to confirm the pattern without guessing
To avoid blind guessing, look for one or two public emails from the same company. They are usually visible in:
- Press releases
- Signatures on the team page
- PDFs like job ads or whitepapers
Two confirmed examples are enough to lock in the pattern. If the existing addresses follow firstname.lastname@company.com, you can apply the same rule to a prospect you found on LinkedIn. Combined with an email finder, this method beats blind guessing by a wide margin.
Method 4: use Google with smart search operators
Searches with simple operators
Google is still one of the strongest tools to find a public work email. Search operators turn billions of indexed pages into a directory of professional addresses that have been published openly. A few queries to try:
"firstname lastname" "@company.com"(associates a name with a known domain)"firstname lastname" company filetype:pdf(digs into PDFs that often contain contact info)intext:"@domain.com" -site:domain.com(surfaces emails published outside the company’s own site)intitle:"contact" "team" domain.com(targets pages with contact details)
These combinations cut through the noise and pull verifiable addresses without paying for a tool.
Find email occurrences on a specific domain
Google indexes pages from conference bios, press kits, team pages, and job posts, even ones that have since been removed from the original site. To narrow your search:
site:company.com "@company.com" filetype:pdf OR filetype:doc(limits results to internal documents)- Check the cached version (three dots > “Cached”) if the email was recently removed.
For international searches, use the local Google domain (google.fr, google.de, etc.), which indexes regional content better.
Whatever you find this way, run it through an SMTP verification before sending. A public email is not always an active one.
Method 5: use LinkedIn and social media to surface the contact
Identify the right person (role, seniority, scope)
Start by narrowing your LinkedIn search to the exact person you want. Use the right job title (e.g. “Marketing Director”), the right seniority (“Senior”, “Head of”), and the right region or sector. That filtering kills the homonym problem and prevents you from reaching out to someone with the same name in a different role.
Sales Navigator filters help: cross-reference company, location, and job-related keywords. Once you have the right profile, you know your outreach is going to a real decision-maker, not a near-match.
Check visible contact info, then go direct
Open the “Contact info” section of the profile to see whether an email or a phone number is publicly shared. Roughly one in ten LinkedIn users surfaces these details, and they are visible to your connections. If nothing is public, send a short and respectful direct message asking for it: “Could you share your work email so we can discuss [specific topic]?”
Avoid scraping: it violates LinkedIn’s terms of service and gets your account flagged or restricted.
Creators and experts: emails often visible in bios and content
Creators, founders, and subject-matter experts often publish their email in their LinkedIn bio, in posts, or in newsletter footers, on purpose, to attract opportunities. Watch out for obfuscated formats like “firstname at domain.com” or “firstname[at]domain.com” and translate them back to a real address. These are emails the person has explicitly chosen to make public, usually for networking or partnerships.
Method 6: use an email finder (when you have name + company)
When it makes sense (B2B, volume, time saved)
Email finders earn their place when you already have a name and a company and want the email in seconds. They generate the most likely work address and run a verification check on top, so you do not have to guess. They are the right move when you are working through a list of leads or scaling outbound, where manual lookups would eat your day.
The best ones publish hit rates above 90% and refresh their databases daily.
How to choose a tool: coverage, verification, freshness, export
When you compare email finders, look at four things:
- Coverage: large databases (200M+ B2B contacts) increase the odds of a hit on niche profiles.
- Verification: multi-step checks, including SMTP validation and AI-based bounce or catch-all detection.
- Freshness: data refreshed daily, not quarterly.
- Export: smooth CSV and CRM integrations so the data flows into your sequence tool without manual work.
Examples of how the category breaks down: Hunter is strong for domain-level searches, Dropcontact differentiates on GDPR-clean enrichment, Apollo is built for high-volume outbound. Most have a free tier you can run a small test on before committing.
Bulk vs unitary: do not burn your domain by sending too fast
If you are working with a list, bulk enrichment via CSV is the right tool. But ramp up gradually: start with batches of 10 to 50 leads to test deliverability before scaling. Always re-verify the addresses your finder returns through built-in or third-party tools. Pace your sending (a common rule is 50 emails per day per domain when you are warming up) to protect your sender reputation. That pacing also lifts open rates over time.
The non-negotiable step: verify the address before sending
Why verification matters (bounces, sender reputation, deliverability)
Verification is the gate between “I have an email” and “I should send to it.” It catches hard bounces, the permanent rejects from addresses that do not exist. Once your bounce rate climbs above 5%, mailbox providers start treating you as a low-trust sender. That is enough to drop your reputation across the board.
A degraded sender reputation hurts every campaign downstream, even ones with great copy. Legitimate emails start landing in spam folders. The fix is upstream: clean your list before you send by checking syntax, domain existence, and SMTP response. That keeps your sender score healthy and your open rates where they should be.
Handling “uncertain” cases (catch-all, high risk, duplicates)
For catch-all domains (which accept every email, even non-existent ones), high-risk addresses (disposable emails, spam traps), and duplicates, apply a strict rule: drop anything below a 90% confidence score. Sending to those addresses costs you more than it earns.
If you really need to reach the person behind an uncertain address, switch channels. A targeted LinkedIn message, a call to the company’s main line, or a contact form gets you in without putting your email infrastructure at risk.
What to do if you cannot find the email: simple alternatives
Call the main line to get the right contact
A direct call to the company’s main number still works. Lead with a clear, specific ask: “Hi, could you give me the email address for the [function] lead? I am putting together something specifically for them.”
That direct approach skips opaque inboxes and often connects you with the gatekeeper who routes inbound, which itself signals you are serious.
Ask for a warm intro through a shared contact
Use your network. LinkedIn shows shared connections at a glance. A warm intro converts at a much higher rate than a cold one because it inherits trust from the connector. Send a short message to your shared contact: “Could you intro me to [name]? I would like to talk with them about [specific value].” Make it easy for them to forward.
Reach the right generic alias when one exists
When the company publishes generic aliases like info@domain.com, contact@domain.com, or sales@domain.com, use them. They typically route to the right team and avoid the bounce risk of guessed addresses.
Before you send, run an SMTP check on the alias to make sure it is actually monitored. A neglected info@ inbox is worse than no email at all.
Common mistakes to avoid
Emailing a personal address without consent
Reaching out to a personal email without explicit consent risks GDPR complaints and an immediate spam-list flag. Personal addresses sit outside the professional context and were not given to you for outreach. Keep your outreach to the work context, tied to the person’s role and the company’s activity. That is both legal and the only way to build a relationship that lasts.
Guessing 10 addresses and emailing all of them
Sending the same message to firstname.lastname@, f.lastname@, lastname.firstname@, and three more variants triggers multiple hard bounces, which tank your sender reputation. It also annoys the prospect, who may receive duplicates or get an internal alert from IT. Either way, your conversion odds drop to zero.
Not adapting the message to the person’s context
Generic copy gets deleted in seconds. If your message could go to anyone with the same job title, it has no anchor. Tie the email to the recipient’s actual situation: their role, a recent post they wrote, a hiring decision, a problem visible from outside. Lead with one specific benefit and end with a low-friction ask, like “Worth a 15-minute call?” That is what gets replies.
Speeding up B2B email finding and activation with Zeliq
Find the right person, then enrich the work email at the right moment
Zeliq’s contact database lets you target by job title, industry, and company size across 450M+ contacts. From there, you enrich the work email and direct phone number on demand, so you can activate leads at the moment that matters. The combination of ICP targeting and waterfall enrichment across 40+ providers returns verified data: about 80% on emails and 60% on direct phones. That removes most of the manual lookup work and keeps your pipeline fed.
Enrichment and verification to cut bounces
Waterfall enrichment cross-references multiple providers and runs automatic verification, so the data you send into is clean. That cuts bounces, lifts deliverability, and catches risky cases like catch-all domains. Drop in a CSV or a LinkedIn list and the enrichment runs in seconds. The credit model is straightforward: one credit per validated email, so you only pay for what you can actually use.
Switch to multichannel when email is not workable
If the email comes back unusable or the catch-all risk is too high, multichannel sequences let you switch to LinkedIn, calls, or follow-ups based on engagement signals, without overloading the same channel. Every interaction lives in one dashboard synced with your CRM. The result: you keep momentum on the lead without burning your sender reputation.
Conclusion
You now have six methods to find a work email: official sources, domain and pattern detection, Google operators, LinkedIn and social, and email finders, plus the verification step that protects your deliverability. Skip the verification and the rest of the work goes to waste.
The biggest wins come from combining manual and tool-based methods, and from staying disciplined: respect the line between work and personal addresses, never blast to guessed variants, and always tailor the message to the person you are reaching. Start with 10 prospects today, target sharply, enrich, personalize, and measure replies. With a tool like Zeliq layered on top, you can scale that loop into a real outbound engine.
Enter the future of lead gen
