New Playbook: Cold Email Infrastructure Setup Guide

Read Now arrow_forward
Mailsfinder Mailsfinder
Mailsfinder Mailsfinder
Pricing
Compare
Contact
Log In Start Free Trial
Table of Contents expand_more
Ultimate Guide • 2026

How to Find Someone's Email Address in 2026 (Complete Guide)

Five proven methods to find anyone's work email, plus how to verify it before you hit send. Whether you're prospecting, recruiting, pitching journalists, or reconnecting with an old contact, this guide covers every workflow that actually returns a deliverable address.

calendar_todayJun 2026
format_list_numbered5 Methods
verifiedVerification Included
schedule18 min read

lightbulbKey takeaways

  • arrow_rightThe fastest way to find someone's email is to run their name + company domain through an email finder. Mailsfinder gives you 100 free lookups every day with no card required.
  • arrow_rightWhen finders fail, generate the eight most common email permutations (first.last, flast, first, etc.) using an email permutator and verify each one.
  • arrow_rightGitHub commits, SEC filings, conference speaker pages, podcast guest pages, and press releases all leak emails that finder databases sometimes miss.
  • arrow_rightFor LinkedIn-heavy workflows, install one of the best email finder Chrome extensions and pull emails straight from profiles inside Sales Navigator.
  • arrow_rightAlways verify before you send. A 5% bounce rate is enough to wreck your sender reputation; run found emails through an email verifier first.
  • arrow_rightDon't email every permutation hoping one lands. That pattern is a classic spam signal and will get your domain flagged inside a week.
  • arrow_rightFor EU contacts, respect GDPR: a legitimate business reason and a clear opt-out keep you on the right side of the law.

boltTL;DR

To find someone's email, type their name and company domain into an email finder like Mailsfinder; you get a verified result in seconds. If the finder returns nothing, guess the format from the company's known email pattern, then verify before sending.

What you need to start

Every method in this guide works from one of three inputs. The more you have, the higher your hit rate. If you only have one of them, you can still get to a verified email in under a minute.

badge

Their name + company

The most common input. Works with every finder tool. If the company has a unique domain, accuracy is high.

link

Their LinkedIn URL

Best for accuracy because the URL is a unique identifier. Chrome extensions extract the email straight off the profile page.

language

Their domain only

Useful when you want to find anyone at a company (a hiring manager, head of partnerships, founder). Run a domain search and pick from the list.

info

If you don't have any of these (you only know a Twitter handle, a podcast appearance, or a "the CTO of X"), start at Method 3 below. Public records are how you bootstrap the inputs you need for everything else.

1

Method 1: Use an email finder tool

This is how 95% of professional outreach gets done. An email finder tool takes a name and a company (or domain) and returns a verified email in two to five seconds. Most tools maintain a database of millions of known email patterns and live SMTP checks, so what you get back is usually deliverable.

If you only try one method from this guide, try this one first. It costs nothing on the free tier and works for the majority of B2B contacts.

How to use an email finder in three steps

  1. 01.Open the free email finder. No signup is required for the first lookup.
  2. 02.Type the person's first name, last name, and company domain (for example: Jane Doe + acme.com).
  3. 03.Hit search. The tool returns a verified email with a confidence score. Anything above 90% is safe to send to.

Recommended tools

Mailsfinder

Free tier: 100 lookups per day, no card required. Paid: from $49/mo for 10,000 credits.

Best when you want a generous free tier and built-in verification on every result. Works from name + domain or a LinkedIn URL.

Hunter.io

Free tier: 50 credits per month. Paid: from $34/mo (annual) for 2,000 credits.

Strong domain search feature: type a company URL and Hunter lists every email pattern it has on file. Great for finding "anyone at this company".

Apollo.io

Free tier: 75 credits per user per month. Paid: from $49/user/mo (annual).

Heavier all-in-one platform with a contact database of 275M+ people. Useful when you need filters (title, seniority, geography) on top of finding.

Snov.io

Free tier: 50 credits + 100 recipients. Paid: from $29.25/mo (annual).

Bundles finding with a drip campaign tool. Good if you want to find and send from the same dashboard.

tips_and_updates

Pro tip: If your first finder draws a blank, try a second one before falling back to Method 2. Different vendors have different data sources, and a name that's missing from Hunter's index may sit happily inside Apollo's. See our full breakdown of the best Hunter.io alternatives for vendor coverage by region.

2

Method 2: Guess the email format and verify

When the finder comes up empty (and it does, especially for smaller companies and EU contacts), the next move is to generate likely format permutations and verify each one. This works because most companies use a single consistent email format across the whole org.

The trick is: don't email every permutation. Verify first. Sending 8 emails to permutations is the single fastest way to torch your sending reputation.

The eight most common email formats

PatternExample (Jane Doe at acme.com)How common
first.last@jane.doe@acme.com~37% of companies
first@jane@acme.com~17%
flast@jdoe@acme.com~14%
firstlast@janedoe@acme.com~9%
first_last@jane_doe@acme.com~6%
firstl@janed@acme.com~4%
last@doe@acme.com~3%
f.last@j.doe@acme.com~2%

How to guess + verify in practice

  1. 01.Detect the company's pattern first. Run their domain through our email pattern detector or look at a known employee email from a press release or contact page.
  2. 02.Generate the permutations using an email permutator. Paste the name + domain and the tool spits out the eight standard formats.
  3. 03.Run all eight through a verifier. Anything that comes back "valid" is the one you send to. Use the free email verifier for single addresses or the bulk email verifier for a list.
  4. 04.If every permutation comes back catch-all or unknown, the company uses a catch-all server (every address resolves as valid). Treat this as a "risky" signal and move to Method 3 or 4 for confirmation.

Browser extensions can automate this whole flow. We've reviewed the best email finder Chrome extensions that combine permutation + SMTP verification + one-click LinkedIn integration in a single sidebar.

3

Method 3: Search public records

Sometimes the database doesn't have it, the pattern doesn't match, and a finder won't help. That's when you go hunting. People leak emails into public records constantly, and once you know where to look, you can usually pull one out in five minutes.

Where emails hide in plain sight

codeGitHub commits

Every Git commit embeds the committer's email by default. Open a developer's GitHub profile, click any public repo they contribute to, and check git log or the commits tab. For most engineers, you'll get their personal or work email within two minutes. This is the single best method for finding a CTO, lead engineer, or any technical hire.

co_presentConference speaker pages

Speakers at conferences often list a contact email on the event's speaker page (so attendees can reach them). Try the speaker's name + conference name in Google, or browse past speaker rosters for industry events like SaaStr, Web Summit, INBOUND, and your vertical-specific conferences.

descriptionSEC filings & EDGAR

If your target is a C-suite executive at a US-listed public company, the SEC's EDGAR database is gold. Form 10-Ks, DEF 14As, and 8-Ks often list officer emails directly. Search for the company on edgar.gov and download recent filings.

campaignPress releases

Almost every press release ends with a media contact email. PR Newswire, Business Wire, and the company's own press page are all worth a Ctrl+F. Even if the contact is a PR person, they can route you to the right exec in one hop.

micPodcast guest pages

Guests on niche podcasts often list a contact in the episode description. Search "[Name] podcast" on Apple Podcasts, Spotify, and YouTube. The guest's email is sometimes in the show notes, the host's intro, or the guest's personal site that the show links to.

personPersonal websites & portfolios

For freelancers, consultants, writers, and execs with a personal brand, their own website almost always has a contact email. Try [firstname][lastname].com, [firstname].dev, [firstname].me, or search "[Name] personal site" on Google.

Google search operators that work

  • search"firstname lastname" + "@company.com" — surfaces any public page where both appear together.
  • search"firstname lastname" filetype:pdf — bios, conference programs, and resumes often contain emails.
  • searchsite:linkedin.com "firstname lastname" "company" — locates a specific LinkedIn profile fast.
  • searchsite:company.com "contact" OR "email" — pulls contact pages off the company's own website.
4

Method 4: Use LinkedIn Sales Navigator + an extension

LinkedIn is the single largest verified-identity database in B2B. The challenge is that LinkedIn itself doesn't expose email addresses (unless the person has chosen to publish theirs, which most haven't). But Chrome extensions bridge that gap: they read the profile URL, query a finder database in the background, and surface the verified email inside the LinkedIn sidebar.

How to find someone's email via LinkedIn

  1. 01.Install a LinkedIn email finder extension. The best email finder Chrome extensions are Mailsfinder, Hunter, Lusha, Apollo, and Findymail.
  2. 02.Open the person's LinkedIn profile (or Sales Navigator lead page).
  3. 03.Click the extension's "Get email" button. The extension cross-references the LinkedIn URL against its database and surfaces a verified address.
  4. 04.If you have Sales Navigator, you can run this at scale: scrape a search result list and pull emails for every lead in one batch.

When LinkedIn-first works best

  • check_circleRecruiters: Sales Navigator filters (current title, years in role, skills) let you build a hyper-targeted list, then extract emails for the whole list at once.
  • check_circlePartnership leads: Search by title ("Head of BD", "Director of Partnerships") at target companies and pull contact info for the exact decision-maker.
  • check_circleSaaS sales reps: Build account lists in Sales Navigator and feed them straight into a sequencer with verified emails attached.

Watch out for LinkedIn's rate limits. If you scrape too aggressively without a tool that respects daily caps, your account can get restricted. Stick to extensions that throttle their requests (Mailsfinder and Hunter both do).

5

Method 5: Reach out on LinkedIn DM or Twitter (last resort)

When every database has failed you, every public record is a dead end, and you still need to reach this specific person, you ask them directly. It feels low-tech, but it works better than people expect, especially for journalists, creators, and execs who use social platforms actively.

A message template that works

"Hi [Name], I'm working on [specific thing relevant to them] and wanted to share [thing of value, not a pitch]. What's the best email to send it to? Happy to keep it short."

Why this works

  • check_circleYou're asking a small, specific favor (giving you an email) rather than pitching cold.
  • check_circleYou're respecting their time by signaling that the actual ask will be short.
  • check_circleYou're moving the conversation to email, which has way better engagement than DMs for anything longer than two sentences.

For journalists, Twitter DMs convert higher than LinkedIn. For execs and B2B buyers, LinkedIn beats Twitter every time. For creators and YouTubers, check whether they have a Beacons or Linktree page that lists a business email before DMing.

How to verify the email you found

Finding an email is half the job. Verifying it before you send is what protects your domain reputation and keeps your replies coming. A bounce rate above 5% is enough to flag your sender domain at Gmail and Outlook within a week.

What verification actually checks

CheckWhat it confirms
SyntaxThe address is formatted correctly (foo@bar.com pattern).
Domain & MXThe domain exists and has active mail servers ready to receive.
SMTP pingA no-payload connection to the mail server confirms the inbox exists.
Catch-all detectionFlags servers that accept every address (so you know a "valid" result is risky).
Role detectionIdentifies generic addresses (info@, sales@, support@) that have lower reply rates.
Disposable detectionFlags addresses from temporary email providers (10minutemail, etc.).

When to use which tool

For a single address

Use the free email verifier. Paste the address, get a result in two seconds. Free for the first 100 per day.

For a list of 50+ addresses

Use the bulk email verifier. Upload a CSV, get back a cleaned list flagged by status (valid, catch-all, invalid, role).

Most quality finders verify on the fly, so if you got the email from Mailsfinder, Hunter, or Findymail, it's already SMTP-checked. Re-verify only if the email is more than 30 days old (people churn jobs constantly).

Common mistakes and what not to do

blockDon't email every permutation

Sending the same message to jane@, j.doe@, jdoe@, janedoe@, jane.doe@ is the single fastest way to get flagged as spam. Mail servers track this pattern and your domain ends up on Spamhaus before lunch. Always verify before sending; never send to permutations.

blockDon't scrape protected sources

LinkedIn's terms of service prohibit large-scale automated scraping. Stick to extensions that operate within LinkedIn's rate limits, and never use scraping tools that bypass authentication. The legal exposure isn't worth the volume.

blockDon't ignore GDPR for EU contacts

If you're emailing EU-based prospects, you need a legitimate business interest (B2B prospecting qualifies in most member states) and a clear opt-out in every message. You also need to honor data deletion requests within 30 days. Document your basis for processing.

blockDon't trust an unverified email

An email from a finder is only as fresh as the database it came from. If the person changed jobs three months ago, you're about to send a bounce. Either pick a finder that re-verifies on demand, or run every email through a verifier before launching a campaign.

blockDon't pay for a tool before testing the free tier

Every finder has data gaps. The Mailsfinder, Hunter, Skrapp, and Snov free tiers are generous enough to evaluate accuracy on your specific ICP before committing to a plan. Test 20 known emails (people you can confirm) and measure hit rate before paying.

Find specific personas

Different roles leave different trails. Here are the fastest paths for the personas people search for most often.

business_centerHow to find a CEO's email

CEOs are heavily targeted, which means their direct email is often gatekept. Start with SEC filings (for public companies), then try a domain search on Hunter or Apollo and look for "ceo@" or "[firstname]@" patterns. Many startup CEOs publish their email on their personal website or use "[firstname]@[company].com" because they own the company. For larger orgs, you may end up with an EA's address; that's often the most effective path anyway.

If the CEO has a podcast, newsletter, or speaking circuit, those channels usually expose a real email faster than any finder.

person_searchHow to find a recruiter's email

Recruiters are usually easy because their job depends on being reachable. Start on LinkedIn (almost every recruiter has a contact email or InMail-open status visible). For internal recruiters at a target company, run a domain search and filter by title containing "recruiter", "talent", or "people". For agency recruiters, the agency's website almost always lists individual team emails.

For deeper recruiter research, see our list of extensions that work inside LinkedIn Recruiter Lite.

newspaperHow to find a journalist's email

Journalists publish their emails more than any other persona. Check the byline on their recent articles (most publications append a contact email), their Twitter bio, their Muck Rack profile, and their publication's "Contact us" page. Outlets like TechCrunch, Bloomberg, and The Information all maintain a writer directory with contact info.

If their public email is a generic "[publication]@" address, find their direct one by checking older bylines (they often switch to a personal email when they freelance).

workHow to find a hiring manager's email

Job postings rarely name the hiring manager directly, so you have to triangulate. Search LinkedIn for the team's department head at the target company ("VP of Engineering" + "Acme"), then run name + domain through a finder. If the role is brand new, the hiring manager is usually the team's most senior recent hire (look at LinkedIn join dates).

An ATS like Workable, Greenhouse, or Lever sometimes leaks the hiring manager's email in the metadata of the job posting URL. Worth checking.

handshakeHow to find a partnership lead's email

Filter LinkedIn or Sales Navigator by titles like "Head of BD", "Director of Partnerships", "Partner Manager", or "Alliances". These roles are public and easy to identify. Most BD leaders are active on LinkedIn and respond to DMs, so even if the finder fails you have a clear second path.

Frequently Asked Questions

How do you find out someone's email?expand_more
You find out someone's email by running their name and company through an email finder tool, guessing the most likely format and verifying it, or pulling it from a public record like a GitHub commit, SEC filing, or conference speaker page. Mailsfinder gives you 100 free lookups per day, which is enough for most one-off needs.
How do I find out someone's email if I only have their name and company?expand_more
Enter the name and company domain into an email finder. Mailsfinder, Hunter, Apollo, and Snov all accept name + domain as inputs and return a verified email within seconds. If the finder returns nothing, generate the eight to twelve most common format permutations (first.last, flast, first, firstlast) and run each through an email verifier.
How to find someone email for free?expand_more
Mailsfinder offers 100 free lookups per day with no card required, Hunter offers 50 free monthly credits, and Skrapp offers 100 free monthly credits forever. For one-off needs, these free tiers usually cover you. You can also find emails for free by checking GitHub commits, conference speaker pages, and personal websites where people often publish their email directly.
How to find out someone's email using LinkedIn?expand_more
LinkedIn does not show email addresses by default. To find out someone's email via LinkedIn, open their profile and run a Chrome extension that connects to a finder database, or copy their name and current company into a finder tool. Sales Navigator gives you better profile data but the extraction still happens through a third-party finder.
How to find people with email when you only have an email and need their full identity?expand_more
Reverse-lookup tools let you find people with email as the starting input. Apollo, Lusha, and RocketReach all accept an email address and return the matching person, role, and company. You can also paste the email into LinkedIn search or Google search inside quotation marks, which often surfaces a profile or a public bio that mentions the address.
How can you find someone's email if they are not in any finder database?expand_more
When databases come up empty, you can find someone's email by checking their personal website, their GitHub commit history (emails are embedded in every commit), conference speaker pages, SEC filings if they are an executive at a public company, podcast guest descriptions, and press releases. As a last step, send a short message on LinkedIn or Twitter asking for the best email to reach them at.
How can you find out someone's email without paying for a tool?expand_more
Free options include the daily free tier on Mailsfinder, the free Chrome extension from Hunter, public sources like GitHub and conference pages, and clever Google search operators (site:linkedin.com "name" OR "company" filetype:pdf). You can also find out someone's email by guessing the format from publicly visible team emails on the company website and verifying with a free verifier.
How can I find out someone's email at a specific company?expand_more
Run a domain search on Mailsfinder, Hunter, or Apollo. Type the company domain and you get back every email pattern the tool has on file, plus a list of known employees. From there, pick the person whose email you want, and the finder returns the verified address. This approach works especially well for finding a hiring manager or department head at a specific company.
How can I find someone's email if I know their Twitter handle but not their name?expand_more
Click through to their Twitter bio, which usually links to a personal website or company page that lists their full name. From there, run the name + domain through a finder. You can also send a Twitter DM asking for the right email, which often works for journalists and creators who actively use the platform.
How to find someone with email already validated and ready to send?expand_more
Use a finder that bundles verification with the lookup. Mailsfinder, Hunter, Findymail, and Apollo all verify emails inside the same credit, so every result that comes back is SMTP-checked and ready to send. If you find an email manually (from a public source) run it through a standalone verifier before adding it to any cold campaign.
How to find someone by email address (reverse lookup)?expand_more
Reverse lookup is the inverse of email finding. Tools like Apollo, RocketReach, and Lusha accept an email and return the matching contact record (name, title, company, LinkedIn URL). You can also paste the email into Google inside quotation marks or search it on LinkedIn directly; this works well for emails that the person has shared publicly at any point.
Harsh Shah

About the author

Harsh Shah

Founder, Mailsfinder

Harsh founded Mailsfinder after running outbound for hundreds of B2B teams and watching the same gap repeat: tools that generate sends but not replies, SEO that generates traffic but not pipeline. He currently consults for ClickUp and three other B2B SaaS companies on pipeline-driven SEO and outbound, and previously led growth at Databox and Darwinbox. Across 50+ B2B SaaS engagements he scaled one platform from $2K to $50K MRR through organic search, drove 35% traffic lifts via content audits, and launched comparison pages with 22% conversion lift.

Expertise: Pipeline-driven SEO and AEO, first-principles outbound, B2B SaaS growth consulting, email deliverability, comparison and alternative page SEO

Deeper comparisons and use-case guides worth reading alongside this guide.

Find any email in seconds

Start with 100 free lookups every day, no card required. Verified emails, built-in deliverability scoring, and a permutator for the tricky ones.

No credit card required • 100 free lookups per day • Cancel anytime