How to Find Anyone’s Email Address: 12 Methods That Work in 2026

Finding someone’s professional email address is the foundation of every outbound sales campaign, recruiting effort, and business development initiative. Without a verified email, you cannot start a conversation. Yet most professionals guard their email addresses carefully, and company websites rarely publish them in plain text. The challenge is real, but the methods for solving it have never been more effective.

After testing every major technique across thousands of lookups, we have identified twelve methods that consistently work in 2026. These range from free manual techniques you can execute in seconds to enterprise-grade tools that find emails at scale. Each method is ranked by accuracy, speed, and cost, so you can choose the right approach for your specific use case.

Whether you are a sales rep trying to reach a VP of Engineering, a recruiter sourcing passive candidates, or a founder pitching investors, at least one of these methods will get you the email address you need.

Method 1: LinkedIn + Email Finder Tools (Accuracy: 85–92%)

The single most effective method for finding professional email addresses in 2026 is combining LinkedIn with a dedicated email finder tool. The process is straightforward: find the person on LinkedIn, then use a browser extension or web app that cross-references that LinkedIn profile against its database of known email addresses.

Tools like Hunter.io, Apollo.io, and Sales.co maintain databases of hundreds of millions of verified business email addresses. When you provide a name and company, these tools match against their database and return the most likely email with a confidence score. The best tools achieve 85–92% accuracy on their verified results, meaning that when they return a result marked as “verified,” it is correct nearly nine times out of ten.

The workflow typically takes under 10 seconds per lookup. Install the browser extension, navigate to a LinkedIn profile, click the extension icon, and the email appears. For bulk lookups, most tools offer CSV upload where you provide a list of names and companies and receive emails in return. At scale, this is the most cost-effective method, running $30–100 per month for 1,000–5,000 lookups depending on the provider.

The limitation is coverage. No database contains every professional email address. Coverage rates vary by industry, company size, and geography. US-based B2B contacts at companies with 50+ employees have the highest coverage at approximately 80%. International contacts, small businesses, and personal email addresses have significantly lower coverage, sometimes below 40%.

Method 2: Company Email Pattern + Permutation (Accuracy: 75–85%)

Every company uses a consistent email format for its employees. The most common patterns are firstname.lastname@company.com (used by 36% of companies), firstnamelastname@company.com (18%), firstinitiallastname@company.com (14%), and firstname@company.com (12%). If you can identify the pattern a company uses, you can construct any employee’s email with high confidence.

To identify the pattern, start by finding one known email address at the company. Check the company’s website for contact pages, press releases, or team bios that include email addresses. Look at SEC filings, conference speaker listings, or GitHub commits from employees. Even a single confirmed email reveals the pattern for the entire organization.

Once you know the pattern, construct the target email using the same format. If you confirmed that john.smith@acmecorp.com is valid, then jane.doe@acmecorp.com is almost certainly the correct format for Jane Doe at the same company. This method achieves 75–85% accuracy because companies occasionally have exceptions—acquired employees, common name conflicts, or executives with custom addresses.

For automation, email permutator tools generate every possible combination of a name and domain. A typical permutation for “Jane Doe” at acmecorp.com produces 15–20 variations: jane.doe@, janedoe@, jdoe@, jane.d@, j.doe@, and so on. You then verify each variation using SMTP validation to identify which one accepts mail. This two-step process—permutation followed by verification—is one of the most reliable free methods available.

Method 3: Google Search Operators (Accuracy: 40–60%)

Google indexes billions of web pages, and many of them contain email addresses in plain text. Advanced search operators let you find these pages with precision. This method is completely free and can surface email addresses that no paid tool has in its database.

The most effective search queries combine the person’s name with their company domain and email-specific operators. Here are the exact searches that produce the best results:

• “Jane Doe” “@acmecorp.com” — Finds pages where both the name and an email at that domain appear together.
• site:acmecorp.com “Jane Doe” email — Searches only the company’s website for the person’s name near the word “email.”
• “Jane Doe” acmecorp email OR contact — Broader search across the entire web for the person’s contact information.
• site:linkedin.com/in/ “Jane Doe” “acmecorp” — Finds the person’s LinkedIn profile, which you can then use with an email finder tool.
• filetype:pdf “Jane Doe” “@acmecorp.com” — Searches PDF documents, which often contain email addresses in speaker bios, whitepapers, and conference proceedings.

Google search operators work best for executives, speakers, and public-facing professionals whose email addresses appear in conference programs, press releases, and industry publications. For mid-level employees who do not have a public profile, this method has lower success rates. Expect to find the email approximately 40–60% of the time, depending on how public the person’s professional activities are.

Method 4: Hunter.io Domain Search (Accuracy: 80–90%)

Hunter.io’s Domain Search feature lets you enter a company domain and see all known email addresses associated with it. This is invaluable for two reasons: it reveals the company’s email pattern instantly, and it often includes the specific person you are looking for in the results.

The free tier includes 25 searches per month, which is sufficient for individual prospecting. Paid plans start at $49 per month for 500 searches. For each domain search, Hunter returns up to 100 email addresses along with their confidence scores and the sources where each email was found. The sources provide transparency—you can verify that the email appeared on a legitimate web page rather than taking the tool’s word for it.

Hunter also provides an “Email Finder” feature where you input a name and domain, and it returns the most likely email address with a verification status. The verified results achieve 80–90% accuracy. Unverified results are less reliable and should be independently confirmed before sending outreach.

Method 5: Apollo.io Prospecting (Accuracy: 82–88%)

Apollo.io combines a contact database with prospecting workflows, making it a one-stop platform for finding emails and launching outreach. Its database contains over 270 million contacts, making it one of the largest professional email databases available. The free tier includes 60 email credits per month with access to basic search filters.

What sets Apollo apart is its filtering capability. You can search by job title, seniority level, company size, industry, technology stack, funding stage, and dozens of other criteria. This makes it exceptionally useful when you need to find not just one person’s email, but a list of 50 VPs of Sales at SaaS companies with 100–500 employees. The bulk export capability delivers these results as a CSV with email addresses ready for outreach.

Apollo’s accuracy varies by contact segment. US-based contacts at mid-to-large companies have the highest accuracy at 85–88%. Smaller companies and international contacts fall to 70–80%. Apollo provides a confidence indicator for each email, and filtering for “verified” results significantly improves reliability.

Method 6: Company Website Research (Accuracy: 30–50%)

Many companies publish email addresses on their websites, especially for leadership teams, sales contacts, and support inquiries. The following pages are the most productive places to look:

• Team / About pages — Sometimes include email addresses alongside bios.
• Contact pages — Often list department-specific emails (sales@, press@) that reveal the domain format.
• Press / News pages — Press releases frequently include a media contact email.
• Job postings — The hiring manager’s email is occasionally listed.
• Blog author bios — Employees who write blog posts sometimes link their email.

Even when you do not find the specific person’s email, finding any email at the company reveals the naming convention. One confirmed email is all you need to construct the target address using the pattern method.

Method 7: Social Media Profiles (Accuracy: 25–45%)

Twitter/X bios, Facebook about sections, and personal websites linked from social profiles occasionally contain professional email addresses. This method is more effective for freelancers, consultants, and executives who actively promote their availability for business inquiries.

On Twitter/X, search for the person’s name along with keywords like “email” or “reach me at.” Some professionals pin a tweet with their contact information or include it in their bio. GitHub profiles are another goldmine—developers often list their work email in their profile or in commit histories.

The accuracy is lower for this method because many social profiles use personal email addresses rather than work addresses. Verifying that the email you find is the person’s current work address requires a secondary confirmation step.

Method 8: SMTP Verification After Permutation (Accuracy: 90–95%)

This is the most technically reliable method for confirming an email address exists. After generating permutations of a name and domain (Method 2), you run each permutation through an SMTP verification service. The service connects to the mail server and checks whether the mailbox exists without actually sending an email.

SMTP verification returns one of several statuses: valid (the mailbox exists and accepts mail), invalid (the mailbox does not exist), catch-all (the domain accepts all email, so existence cannot be confirmed), or unknown (the server did not respond conclusively). For non-catch-all domains, SMTP verification is 90–95% accurate—the highest of any method.

The limitation is catch-all domains. Approximately 25% of company domains are configured as catch-all, meaning they accept email to any address regardless of whether the mailbox exists. For these domains, SMTP verification cannot distinguish between valid and invalid addresses, and you must rely on other methods to identify the correct email.

Free SMTP verification tools include EmailListVerify (free tier), NeverBounce (free trial), and the verification features built into platforms like Sales.co that automatically verify every email before adding it to a campaign.

Method 9: Professional Networking and Direct Ask (Accuracy: 95–100%)

The simplest method is often overlooked: ask for the email directly. If you have a mutual connection, ask for an introduction that includes the person’s email. If you are connected on LinkedIn, send a message asking for their preferred email for business correspondence. If you met at a conference, follow up via LinkedIn and request their email.

This method has the highest accuracy because the person provides their own address. It also has the added benefit of establishing a warm connection before your email arrives, which dramatically increases open and reply rates. The downside is speed—it requires waiting for responses and only works when you have some existing relationship path to the person.

Method 10: WHOIS and Domain Records (Accuracy: 20–35%)

Domain WHOIS records sometimes contain email addresses for domain administrators. While GDPR and privacy protection services have significantly reduced the availability of WHOIS data since 2018, some domains still expose registrant contact information. This method is most useful for finding the email of a company founder or CTO who registered the company’s domain.

Use a WHOIS lookup tool like whois.domaintools.com or the command-line “whois” command. Look for the registrant email, admin email, or tech contact fields. Even when the email is behind a privacy proxy, the proxy address sometimes forwards to the actual registrant, making it a viable contact method in some cases.

Method 11: Industry Directories and Publications (Accuracy: 50–70%)

Industry-specific directories, conference speaker lists, professional association member directories, and academic publication author contacts often include email addresses. These sources are particularly valuable for reaching executives, researchers, and thought leaders whose contact information appears in professional contexts.

For example, Crunchbase profiles sometimes include founder email addresses. IETF mailing lists contain email addresses for technical standards participants. Academic papers on Google Scholar list author email addresses in the paper itself. Patent filings include inventor contact information. These niche sources are often overlooked but can surface email addresses that no commercial tool has in its database.

Method 12: Email Outreach Platform Enrichment (Accuracy: 80–92%)

Modern cold email platforms like Sales.co include built-in email enrichment that combines multiple data sources into a single lookup. Instead of manually trying each method above, these platforms aggregate data from commercial databases, web scraping, SMTP verification, and pattern matching to deliver the most accurate result available.

The advantage of platform-based enrichment is the waterfall approach: if the primary database does not have the email, the system automatically falls back to secondary sources, then to pattern-based generation with verification. This multi-source approach achieves 80–92% accuracy on verified results, comparable to the best standalone tools but with significantly less manual effort.

For teams doing outreach at scale (50+ new contacts per day), platform enrichment is the practical choice. The time saved on manual lookups alone justifies the cost, and the integrated workflow means you go from “name and company” to “verified email in a sending sequence” in a single step.

Accuracy Comparison: All 12 Methods Ranked

Method	Accuracy	Speed	Cost	Best For
Direct Ask / Networking	95–100%	Slow	Free	Warm contacts
SMTP Verification + Permutation	90–95%	Moderate	Free–$20/mo	Single high-value targets
LinkedIn + Email Finder	85–92%	Fast	$30–100/mo	Sales prospecting at scale
Platform Enrichment	80–92%	Fast	$50–200/mo	High-volume outbound teams
Apollo.io Prospecting	82–88%	Fast	Free–$99/mo	Targeted list building
Hunter.io Domain Search	80–90%	Fast	Free–$49/mo	Individual lookups
Email Pattern + Permutation	75–85%	Moderate	Free	Known company pattern
Industry Directories	50–70%	Slow	Free	Executives and researchers
Google Search Operators	40–60%	Moderate	Free	Public-facing professionals
Company Website Research	30–50%	Slow	Free	Identifying email patterns
Social Media Profiles	25–45%	Slow	Free	Freelancers and consultants
WHOIS Records	20–35%	Fast	Free	Domain owners and founders

The Recommended Workflow for 2026

For maximum efficiency, combine methods in a waterfall sequence. Start with the fastest, highest-accuracy method and fall back to slower methods only when the initial lookup fails. Here is the workflow that produces the best results per minute of time invested:

1. Step 1: Run the name and company through an email finder tool (Hunter, Apollo, or Sales.co). Takes 5 seconds. Succeeds 80% of the time.
2. Step 2: If no result, identify the company email pattern using Hunter’s Domain Search or by finding one known email on the company website. Takes 1–2 minutes.
3. Step 3: Generate permutations using the identified pattern and verify via SMTP. Takes 1–3 minutes. Succeeds 90% of the time when the pattern is known.
4. Step 4: If still no result, use Google search operators to find the email in public web pages. Takes 2–5 minutes.
5. Step 5: As a last resort, reach out via LinkedIn or mutual connections to ask for the email directly. Takes hours to days.

Following this waterfall, you will find a verified email address within 5 minutes for approximately 90% of professional contacts at established companies. The remaining 10% require manual research or social outreach, which is acceptable for high-value targets but impractical at scale.

Common Mistakes When Finding Emails

The most frequent error is sending to unverified email addresses. Finding a likely email is only half the job—verification is essential. Sending to invalid addresses damages your sender reputation, increases bounce rates, and can get your domain blacklisted. Always verify before sending, even when you are highly confident in the address.

The second mistake is relying on a single data source. No email database has 100% coverage. Teams that use only one tool accept a 15–30% miss rate that could be eliminated by combining two or three sources. The waterfall approach described above dramatically improves coverage without significant cost increase.

The third mistake is ignoring catch-all domains. When an email finder returns a “catch-all” status, it means the domain accepts all email and the tool cannot confirm whether the specific mailbox exists. Treating catch-all results as verified leads to sending emails that bounce or are silently discarded. For catch-all domains, use additional verification steps like checking LinkedIn for email clues or cross-referencing with a second tool.

The fourth mistake is scraping email addresses from websites without considering context. An email found on a personal blog from 2019 may no longer be the person’s active address. Always check for recency indicators—when was the page last updated? Is the person still at the same company? Has their role changed? Sending to outdated addresses wastes your daily sending quota and degrades campaign performance metrics.

Legal and Ethical Considerations

Finding email addresses is legal in most jurisdictions when the information is publicly available or obtained through legitimate business databases. However, how you use those email addresses is subject to regulations including CAN-SPAM (US), GDPR (EU), and CASL (Canada).

Under CAN-SPAM, you can send cold emails to business addresses as long as you include a physical address, provide an unsubscribe mechanism, and honor opt-out requests within 10 business days. There is no requirement for prior consent for B2B outreach in the United States.

Under GDPR, cold email to EU contacts requires a “legitimate interest” basis, which means you must have a reasonable business reason for contacting the person. Generic mass emails to EU contacts carry significant legal risk. Best practice is to personalize outreach to EU recipients and document your legitimate interest basis for each campaign.

Ethically, respect people’s time and attention. Sending relevant, personalized outreach to people who might genuinely benefit from your product or service is different from blasting thousands of irrelevant emails. The best cold emailers find the right person and send them something worth reading. That starts with finding the right email address and ends with respecting the person behind it.

The Bottom Line

Finding anyone’s email address in 2026 is a solved problem. The combination of commercial databases, pattern recognition, SMTP verification, and search techniques means that a verified email for any professional at an established company can be found in under five minutes. The key is using the right method for the right situation and always verifying before sending.

For individual lookups, start with a free tool like Hunter.io or Apollo’s free tier. For team-scale outreach, invest in a platform like Sales.co that integrates email finding, verification, and sending into a single workflow. Whatever your scale, the twelve methods in this guide give you everything you need to reach anyone in the professional world.