How to find anyone’s work email address

Start with the pattern, not the person

Almost every company uses one email format across the whole organisation. Find the format and you can construct any colleague's address.

The common patterns, roughly in order of how often we see them:

• firstname.lastname@company.com — the most common in B2B
• firstname@company.com — typical at companies under about 50 staff
• flastname@company.com — common in finance and legal
• firstnamel@company.com and firstname_lastname@company.com — less common but real

To find the pattern, you only need one confirmed address at that company. Press releases, job adverts, support pages, PDF documents and conference listings routinely publish one.

The nine methods, ranked by success rate

1. Deduce the company pattern

   Highest success rate of anything on this list, and free. Find one published address, work out the format, apply it to your target. Then verify — never skip that step.

2. The company website's own pages

   Not just the contact page. Check the press or media page, careers page, investor relations, and any downloadable PDF. Legal and compliance pages frequently name an individual.

3. Search operators against the domain

   site:company.com "@company.com" surfaces addresses published anywhere on the site. Add a surname to narrow it. This finds addresses buried in documents that no tool indexes.

4. LinkedIn contact info

   Some people publish an address in the contact panel. Low hit rate, but when it works the address is confirmed rather than guessed.

5. Email finder tools

   Hunter, Apollo, Snov and similar. Genuinely useful, but understand what they are: mostly a database of previously found addresses plus the same pattern-guessing you can do yourself. Coverage is good for US tech, thin elsewhere.

6. Company filings and registries

   For regulated industries this is the highest-quality source available. Company registries, licensing bodies and regulator databases publish named contacts, and the record is authoritative rather than inferred.

7. Conference and event listings

   Speaker pages, exhibitor directories and webinar registrations often publish a direct address for the named person.

8. GitHub and technical sources

   For engineering roles, commit history frequently contains a work address. Niche, but close to 100% accurate when it applies.

9. Ask

   Underrated. A short message through the site's contact form or a receptionist call asking who handles X, and what the best address is, works surprisingly often — and produces a confirmed address, not a guess.

Verifying is not optional

A deduced address is a hypothesis. Sending to it untested is how you damage your sending domain.

Verification checks the address at three levels: whether the syntax is valid, whether the domain accepts mail at all, and whether that specific mailbox exists. Tools like ZeroBounce, NeverBounce and Clearout perform this without sending anything.

The threshold that matters: above roughly 2% bounce rate, mailbox providers start treating your domain differently. At 5% you are in genuine trouble. A single unverified send to 500 guessed addresses can undo months of sender reputation.

Catch-all domains, and why they are not confirmation

Some domains accept mail to any address, existing or not. Verification returns "accept-all", which is not the same as valid. Treat these as unconfirmed: either find corroboration elsewhere, or accept the risk knowingly rather than by accident.

What this looks like at scale

Finding one address is a five-minute task. Finding 500 verified addresses for a defined target list is a different job — and the one we handle as a web research and email-finding service: pattern detection per company, a fallback route when the pattern fails, verification across the whole set, and an honest blank where no address could be established.

On one project we compiled a verified contact for the Public Administrator in all 58 California counties — each one traced to the page it came from, because public-sector staff change and a list without provenance cannot be maintained.

The one rule

Never invent an address to fill a cell. A blank is honest and costs you nothing. A guessed address that bounces costs you deliverability on every subsequent campaign.

Last reviewed 2026-07-28.