How to Find Someone's Email Address (B2B Methods Ranked)

If you need to know how to find someone’s email address for a business conversation, the hard part is not finding an address. It is finding the one that actually reaches the person, today, without bouncing and without landing you on a blocklist. A guessed address that bounces costs you more than no address at all, because every hard bounce chips away at the sender reputation your whole outbound program depends on.

This guide covers work email addresses only: the address someone uses at their company, for business outreach. It ranks the six methods that work, explains how pattern guessing and SMTP verification actually behave, and shows where the common shortcuts break.

The problem: “found” is not the same as “deliverable”

Most people treat email finding as a lookup problem. Type a name and a company into a tool, get an address, send. In practice there are three separate questions:

1. What is the likely address? (pattern, database record, or published source)
2. Does the mailbox exist right now? (verification)
3. Can you prove it, or is the server hiding the answer? (catch-all and greylisting behaviour)

Most tools blend these into one “confidence score”. That score is useful, but if you do not know which of the three questions it answers, you cannot tell a confirmed address from an educated guess. The methods below are ranked by how directly they answer all three.

Six methods, ranked by accuracy

1. The person tells you (or published it themselves)

The most accurate address is the one the person put in public: a conference speaker bio, a GitHub commit, a podcast show notes page, a company “team” page, a press release media contact, or their own email signature in a previous thread. These are first-party and current at the time of publishing.

How to search for it:

• Google: "firstname lastname" "@company.com"
• Google: site:company.com "firstname" email
• Check the company’s press page, which often lists a named media contact
• For technical roles, public commit metadata on GitHub sometimes shows a work address

Caveat: published addresses go stale when people change jobs. Always verify before sending (step 3 below).

2. A shared connection or prior thread

If anyone on your team has emailed this person before, the address is in your CRM or inbox. Check before buying data. It sounds obvious, but SDR teams regularly re-find addresses that already sit in HubSpot or Salesforce under a slightly different company name. A deduplication pass on your CRM prevents this.

3. Pattern detection plus verification

This is the workhorse method for B2B. Most companies use one consistent format for every employee. If you know two or three real addresses at a domain, you know the pattern for everyone.

The common patterns, roughly in the order you will see them:

Pattern	Example for Jane Smith
first.last	[email protected]
first	[email protected]
flast	[email protected]
firstlast	[email protected]
first_last	[email protected]
firstl	[email protected]
last.first	[email protected]

Small companies lean towards first@. Larger organisations lean towards first.last@ because first names collide quickly. Our email pattern detection guide goes deeper on edge cases like hyphenated surnames and subsidiaries on separate domains.

The workflow:

1. Find the company’s mail domain. It is not always the website domain (a brand site might be getacme.io while mail runs on acme.com). Check the MX record (more below).
2. Collect two or three known addresses at that domain from public sources.
3. Infer the pattern and generate the candidate for your person.
4. Verify the candidate.

4. Email finder tools (database plus pattern)

Tools like Hunter, Apollo, Snov.io, RocketReach, and Lusha combine a database of previously seen addresses with pattern inference. You enter a name and domain; they return an address and a confidence label.

Their accuracy depends on how the address was obtained:

• Seen in the wild recently (crawled from a public page, or confirmed by another user): high accuracy
• Generated from the domain pattern and verified: good accuracy, unless the domain is catch-all
• Generated from the pattern, unverified: a guess with a nice label

Good tools show you which of these you are getting. Hunter, for example, lists the public sources where it saw an address. If a tool just gives you “92% confidence” with no sources, treat it as method 3 without the verification step.

5. Waterfall enrichment across multiple providers

No single provider covers every company. A waterfall queries provider A, falls back to provider B if A returns nothing, then C, and verifies the result. Coverage goes up meaningfully compared with any one provider, especially outside the US where data coverage is thinner. The trade-off is cost and complexity. We cover the mechanics in the waterfall approach to email finding.

6. LinkedIn contact info

For first-degree connections, LinkedIn’s “Contact info” panel may show an email address, depending on the member’s privacy setting. It is often a personal address (Gmail, Outlook) rather than a work one, which matters for compliance and relevance. We break this down in our LinkedIn email finder guide.

How SMTP verification actually works

Verification tools do not send an email. They open a conversation with the receiving mail server and stop just before sending:

1. Syntax check: is the address well formed?
2. DNS/MX lookup: does the domain have mail exchanger records? No MX means nothing can be delivered. See MX record validation explained.
3. SMTP handshake: connect to the mail server, issue HELO, MAIL FROM, then RCPT TO:<[email protected]>.
4. Read the response: a 250 code usually means the server will accept mail for that mailbox. A 550 usually means the mailbox does not exist.

Then the verifier disconnects without sending anything.

You can check MX records yourself on any machine:

nslookup -type=mx company.com

If the MX hosts end in google.com the company uses Google Workspace; mail.protection.outlook.com means Microsoft 365. That alone tells you something about how verification will behave.

The catch-all problem (and why “valid” can lie)

A catch-all (or “accept-all”) domain is configured to accept mail for any address at the domain, whether the mailbox exists or not. The server returns 250 for jane.smith@, j.smith@, and nobody-here-xyz@ alike. Verification cannot distinguish a real mailbox from a fake one on these domains.

Some patterns we keep seeing:

• Many enterprise domains, and domains behind security gateways like Proofpoint or Mimecast, behave as catch-all from the outside.
• Some servers greylist unknown senders, temporarily rejecting the first attempt. Cheap verifiers mark these “unknown”.
• Microsoft 365 and Google Workspace both make external mailbox probing less reliable than it used to be, so “unknown” results are common on large domains.

What to do with catch-all results:

1. Do not treat “accept-all” as “valid”. Put these contacts in a separate segment.
2. Only use catch-all addresses where the pattern is strongly confirmed (several real addresses seen at that domain using the same format).
3. Send to catch-all segments in small batches and watch bounce rates closely.
4. If you have a choice, prefer a different contact at the same account with a verifiable address.

Our guide to catch-all email handling has a fuller decision tree.

What most people get wrong

They optimise for coverage instead of bounce rate. A tool that “finds” 90% of addresses with an 8% bounce rate is worse for your program than one that finds 60% with under 2%. Mailbox providers judge you on bounces and complaints, not on how many people you reached. Google’s bulk sender guidance, for example, asks senders to keep reported spam rates below 0.3%, and high bounce rates are one of the fastest ways to look like a spammer.

They verify once and reuse the list for months. People change jobs constantly. An address verified in January is a guess by summer. Re-verify any list older than about 30 to 60 days before you send.

They guess the domain. The website domain and the mail domain differ more often than you would expect, especially after rebrands and acquisitions. Always check MX records.

They ignore personal addresses as a compliance issue. Sending B2B cold email to a personal Gmail address is a different situation under GDPR and most mailbox provider policies than emailing a work address about a work topic. Stick to work addresses for cold outreach.

A repeatable workflow for one contact

Here is the five-minute version an SDR can follow for a single high-value contact:

1. Check the CRM and shared inbox for an existing address.
2. Search Google for "First Last" "@domain" and the company’s team or press pages.
3. Look up the MX record to confirm the mail domain and provider.
4. Run the name and domain through one email finder tool and note whether the result came from a public source or a pattern.
5. Verify the address. If it returns “valid”, use it. If it returns “accept-all”, only use it if the pattern is confirmed by at least two other addresses. If it returns “invalid” or “unknown”, try the next pattern or another contact at the account.

And the version for a list of 1,000:

1. Normalise company domains and dedupe the list.
2. Run a waterfall: database lookup first, pattern generation second.
3. Bulk-verify everything (see our bulk email verification best practices).
4. Split into valid, accept-all, and invalid/unknown segments.
5. Send to valid first. Hold accept-all for a smaller, monitored batch. Drop invalid.

Where tooling helps

Doing this by hand works for a handful of executive contacts. At list scale, it is the kind of repetitive, rule-based work that should be automated. Scrapine’s Email Finder combines pattern detection with multi-source lookups, and Email Verification separates valid, accept-all, and unknown results so you can segment instead of guessing. Whatever tool you use, insist on seeing which of the three questions a result actually answers.

FAQ

Is it legal to find someone’s work email address?

Finding a publicly available business address is generally lawful. What matters is how you use it. In the US, CAN-SPAM requires an accurate sender, a non-deceptive subject line, a physical postal address, and a working opt-out. In the EU and UK, GDPR applies to business contact data about individuals; B2B outreach is usually based on legitimate interest, with a clear opt-out and a privacy notice. See our post on cold email compliance and GDPR.

How accurate are email finder tools?

It depends on whether the address was observed in a public source or generated from a pattern, and whether the domain is catch-all. Ask each vendor to show the source of an address and test them on a sample of contacts whose addresses you already know.

What does “accept-all” mean in an email verifier?

The domain accepts mail for any address, so the verifier cannot confirm the specific mailbox exists. Treat it as “unconfirmed”, not “valid”.

Can I just guess [email protected]?

You can generate it as a candidate, but never send without verifying. A single wrong guess is a hard bounce, and bounces add up fast across a sequence.