Finding Someone’s Email Address: Methods That Work

Looking up someone’s email address is one of those tasks that sounds simple until you actually need to do it. The address isn’t on their website. LinkedIn doesn’t surface it. A Google search returns nothing useful. There are reliable methods that work, and there are a lot of tools and tactics that waste your time.

The most effective approaches combine pattern recognition, purpose-built lookup tools, and a bit of lateral thinking. None of them require anything exotic, and most take less than five minutes once you know what you’re doing.

Why This Question Comes Up More Than People Admit

Most marketing conversations about email focus on what happens after you have a list: segmentation, deliverability, open rates, automation sequences. The upstream question of how you actually get a specific person’s address tends to get glossed over, as if everyone already knows the answer or the question is somehow beneath the conversation.

It isn’t. I’ve worked with sales teams at agencies who were losing hours every week to manual research. I’ve seen business development people sit on a list of 200 target accounts with no contact data and no clear process for getting it. The gap between “we want to reach these people” and “we have a verified email address for them” is where a lot of outreach effort quietly dies.

This sits firmly within the broader discipline of email acquisition, and if you want a fuller picture of how email fits into commercial growth, the Email and Lifecycle Marketing hub covers the channel from first contact through to long-term retention. But this article is specifically about the lookup problem, because it deserves a direct answer.

Start With the Pattern Before You Pay for a Tool

Most professional email addresses follow one of a small number of formats: firstname@company.com, firstname.lastname@company.com, f.lastname@company.com, flastname@company.com. Companies are generally consistent. Once you know the pattern one person at a company uses, you can usually infer the address for anyone else there.

The fastest way to find the pattern is to look at publicly available addresses from the same domain. Press releases, author bylines, conference speaker pages, and LinkedIn posts where someone has shared their contact details all give you usable data. If you can find one confirmed address at a company, you have the template for the rest.

When I was building out new business lists at an agency I ran, we kept a running log of confirmed email formats by company. It sounds low-tech, and it is, but it saved significant time. The pattern for a 500-person B2B company almost never changes, and once you’ve confirmed it once you don’t need to re-derive it for the next contact at the same business.

If you’re not sure which format a company uses, you can test your best guess using an email verification tool before you send anything. Most tools will tell you whether the address is valid without actually delivering a message. That step matters, and I’ll come back to it.

The Lookup Tools Worth Using

There is a category of purpose-built tools that exist specifically for this problem. They vary in accuracy, pricing, and the size of their databases, but the best ones are genuinely useful and save a lot of manual effort.

Hunter.io is the most widely known. You enter a domain name and it returns a list of email addresses it has found associated with that domain, along with the pattern it has identified. The free tier allows a limited number of searches per month, which is enough for occasional use. The paid tiers are worth it if you’re doing this regularly. Hunter also has a browser extension that surfaces addresses when you’re on a company’s website or a LinkedIn profile.

Apollo.io has grown significantly and now combines email lookup with a broader prospecting database. It’s more useful if you’re building targeted lists at scale rather than looking up a single contact, and its filtering by role, industry, and company size makes it practical for structured outreach campaigns.

Snov.io is a solid alternative with a similar feature set to Hunter. It includes an email verifier and a drip campaign tool if you want everything in one place. The database quality is generally reliable for professional addresses.

RocketReach and Lusha are also worth knowing. Both index professional contact data and surface addresses with reasonable accuracy. Lusha has a strong LinkedIn integration that makes it useful for individual lookups during research.

None of these tools are infallible. Addresses change when people move jobs, companies restructure, or domains get updated. A result from any of these tools is a strong lead, not a guarantee. Verify before you send.

Using LinkedIn Without Paying for a Premium Tool

LinkedIn doesn’t display email addresses by default, but there are legitimate ways to surface them through the platform. If you’re connected with someone at first-degree level, their contact information is often visible on their profile under the “Contact info” section. Not everyone fills this in, but enough people do that it’s worth checking before you go anywhere else.

LinkedIn Sales Navigator includes contact data enrichment as part of its feature set, though the coverage varies and it’s an expensive subscription to justify purely for email lookup. If you’re already using it for prospecting, the contact data is a useful addition.

Sending a connection request with a clear, specific message explaining why you want to connect is also a legitimate approach. It takes longer and requires a response, but it produces a warmer contact than a cold email to an address you’ve inferred. In my experience, a well-written InMail or connection request to a relevant prospect converts better than a cold email to a guessed address, because the context is visible from the start.

What Google Can Surface That Most People Miss

A direct search for someone’s name and email address rarely returns anything useful. But more targeted searches often do. Searching for the person’s name alongside their company domain, or their name alongside “contact” or “@”, can surface pages where they’ve posted their address publicly. Conference websites, academic papers, podcast guest pages, and industry directories are all common sources.

The search operator approach is worth knowing. Searching for site:company.com "firstname lastname" or "@company.com" "firstname" in Google can return internal pages or documents where addresses appear. It’s not reliable for every target, but for public-facing professionals it works more often than people expect.

WHOIS records are another underused source. If the person you’re looking for owns a domain, the registrant contact information is sometimes publicly available through WHOIS lookup tools. This is more relevant for founders and small business owners than for employees at larger companies, but it’s a useful fallback.

Verifying an Address Before You Use It

Finding an address and sending to it without verification is one of the more avoidable mistakes in email outreach. Sending to invalid addresses generates hard bounces, and hard bounces damage your sender reputation. Once your domain reputation degrades, deliverability suffers across your entire sending programme, not just the outreach campaign that caused the problem.

Email verification tools check whether an address is valid without sending a message. They do this by querying the mail server for the domain and checking whether the mailbox exists. Most verification tools return one of three results: valid, invalid, or unknown (where the server won’t confirm either way). Valid results are safe to send to. Invalid results should be removed. Unknown results are a judgment call, and I’d generally suppress them for cold outreach.

NeverBounce, ZeroBounce, and Mailfloss are all reliable verification tools. Hunter’s built-in verifier is good for individual lookups. If you’re working with a list of any size, running it through a dedicated verifier before you load it into your sending platform is worth the small cost. Understanding how email suppression lists work is part of the same discipline, because managing bounces and unsubscribes correctly is what protects your sender reputation over time.

The deliverability problem is real and it compounds. I’ve seen campaigns built on unverified lists hit spam folders at rates that made the whole effort pointless. Getting past spam filters is a technical and reputational challenge, and HubSpot’s breakdown of email spam filters is a useful reference for understanding what’s working against you when deliverability drops.

The Compliance Question You Can’t Skip

Finding an email address is one thing. Using it is another. The legal framework around unsolicited email varies by geography, and the consequences of getting it wrong range from reputational damage to regulatory fines.

Under GDPR, which applies to anyone contacting individuals in the EU regardless of where the sender is based, you need a lawful basis for processing contact data. For B2B cold outreach, “legitimate interests” is the most commonly cited basis, but it requires a genuine, documented business reason and a clear opt-out mechanism in every message. It is not a blanket permission to email anyone whose address you’ve found.

CAN-SPAM in the US is less restrictive for B2B outreach but still requires honest subject lines, a physical address, and a functioning unsubscribe mechanism. CASL in Canada is stricter and requires express or implied consent before sending commercial messages.

The practical upshot is that if you’re doing legitimate B2B prospecting, reaching out to someone in a relevant professional context with a clear business reason, and you give them an easy way to opt out, you’re generally on solid ground. If you’re scraping addresses at scale with no clear relevance or consent framework, you’re not. The distinction matters both legally and practically, because irrelevant cold email doesn’t convert anyway.

I’ve judged the Effie Awards and reviewed a lot of marketing work over the years. The campaigns that hold up commercially are built on genuine relevance, not volume. Blasting an unverified list of scraped addresses is the kind of activity that looks like marketing but doesn’t function like it.

What to Do Once You Have a Verified Address

Having a verified address is the starting point, not the result. The quality of your first message determines whether the effort of finding the address was worth anything.

Cold email works best when it’s genuinely personalised, specific about why you’re reaching out, and clear about what you’re asking for. Generic openers, long paragraphs about your company’s capabilities, and vague calls to action are the fastest way to get ignored or marked as spam. The research on what makes cold email effective points consistently in the same direction: shorter, more specific, more relevant.

Personalisation in email marketing has a measurable effect on response rates, but it requires actual personalisation, not just inserting a first name. Referencing something specific about the person’s role, their company’s recent activity, or a shared context gives the message a reason to exist. Without that, you’re just another email in an inbox that’s already full.

If your outreach is part of a sequence rather than a single message, automated follow-up sequences can be set up to send at intervals based on whether the first message was opened or clicked. The follow-up is often where the response comes, because the first message plants the seed and the second arrives when the person has more time or headspace.

Early in my career, I was on the receiving end of a lot of agency pitches that came via cold email. The ones that got responses were specific, brief, and had done basic research. The ones that didn’t were long, generic, and clearly sent to a list. That dynamic hasn’t changed. The tools have improved, but the underlying principle hasn’t.

When to Build a List Rather Than Look Up Individuals

Individual email lookup makes sense when you have a short list of specific, high-value targets. It doesn’t scale well beyond a few hundred contacts without significant tooling investment, and at that point you’re better off thinking about list building as a structured programme rather than a series of one-off lookups.

Content-led list building, where people opt in because they want what you’re offering, produces a fundamentally different kind of list. The contacts are warmer, the deliverability is better, and the compliance position is cleaner. It takes longer to build, but the commercial return per contact is higher. I’ve seen this play out repeatedly across the agencies I’ve run: a well-maintained opt-in list of 5,000 contacts outperforms a scraped list of 50,000 almost every time, because engagement drives deliverability and deliverability drives results.

If you’re trying to grow an email list rather than look up specific individuals, social channels can be a useful acquisition source. Using video content to grow your email list is one approach that works well for B2C and some B2B contexts, particularly when the content itself provides enough value to justify the opt-in.

The right approach depends on what you’re actually trying to accomplish. If you need to reach ten specific decision-makers at ten specific companies, individual lookup is the right tool. If you’re trying to build a pipeline of 500 prospects over the next quarter, a structured prospecting programme with Apollo or a similar tool is more appropriate. If you’re trying to grow a subscriber base for content marketing, opt-in acquisition is the only approach worth building on.

There’s more on the full lifecycle of email as a channel, from acquisition through to reactivation and retention, in the Email and Lifecycle Marketing section of The Marketing Juice. The lookup question is one part of a larger system, and it’s worth understanding how it connects to everything downstream.

A Note on Inactive Contacts and List Hygiene

Whether you’ve built your list through lookup or opt-in, contacts go stale. People change jobs, change email providers, or simply stop engaging. An address that was valid and active eighteen months ago may be inactive or bouncing today.

Regular list hygiene, removing hard bounces promptly, suppressing persistent non-openers, and re-engagement campaigns for inactive contacts, is what keeps a list commercially useful. Managing inactive contacts on your email list is a practical discipline that most marketers underinvest in. The instinct is to keep the list as large as possible. The commercial reality is that a smaller, engaged list outperforms a larger, disengaged one on every metric that matters.

When I was managing email programmes for clients across multiple sectors, the pattern was consistent: the clients who obsessed over list size and ignored engagement rates consistently underperformed the clients who treated their list as a quality asset rather than a volume metric. The number in the database is vanity. The number of people who open, click, and convert is the business.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions