Finding Someone’s Email Address: Methods That Work

Finding someone’s email address is a practical problem with a short list of practical solutions. The most reliable methods involve public data sources, professional networks, domain-based pattern matching, and purpose-built lookup tools, used in combination rather than in isolation.

None of this is complicated. But doing it well, meaning finding the right address, verifying it before you send, and approaching the outreach in a way that gets a response, requires more thought than most people apply to it.

I have spent a large part of my career on the new business side of agency life. That means a lot of cold outreach, a lot of thinking about who to contact and how to reach them, and a lot of lessons learned about what actually moves the needle versus what just burns time. The mechanics of finding an email address sit right at the start of that process, and getting them wrong costs more than people realise.

Why the Method You Choose Matters More Than You Think

There is a temptation to treat email address lookup as a solved problem. Type a name into a tool, get an address, send an email. The reality is messier. Tools have varying accuracy rates depending on the industry, company size, and geography you are searching in. Free tiers are limited. Some tools are better for enterprise contacts, others for SMEs. Some are strong on US data, weaker elsewhere.

More importantly, an address that looks right is not the same as an address that is right. Sending to a bad address hurts your sender reputation. Do it at scale and your deliverability suffers across all your outreach, not just the bad batch. I have seen agencies run prospecting campaigns on lists that had not been cleaned in eighteen months and wonder why their open rates had collapsed. The list was the problem, not the subject line.

If you are building your email outreach capability more broadly, the Email and Lifecycle Marketing hub on The Marketing Juice covers the full picture, from acquisition through to retention and reactivation.

Start With What Is Already Public

Before you reach for a tool, check what is already visible. A surprising number of professional email addresses are publicly accessible if you know where to look.

Company websites. The contact or team page is the obvious starting point. Many organisations, particularly smaller ones, list individual email addresses directly. Even when they do not, the format of any visible address (for example, a press contact or a general enquiries address) tells you the company’s email naming convention. That is useful.

LinkedIn. LinkedIn does not typically show you someone’s email address without a connection, but it tells you where they work and what their role is. That is often enough to narrow things down significantly. Some people do include their email in their contact info section, visible to first-degree connections. It is worth checking before you go further.

Twitter/X and other social profiles. People share contact details in bios more often than you might expect, particularly freelancers, consultants, and anyone actively looking for inbound work. A quick scan of their public profiles takes thirty seconds.

Press releases and media coverage. PR contacts are usually named and their email addresses are often included. If the person you are trying to reach has been quoted in industry coverage, the journalist who wrote the piece may have contact details, or the press release itself might.

Published papers, event speaker bios, and conference programmes. If your target is in a sector where people speak or publish, these are reliable sources. Academic and professional email addresses are routinely included in these contexts.

Email Pattern Matching: The Underused Method

Once you know where someone works, you can often work out their email address without a tool at all. Most organisations use a consistent naming convention across their workforce. Common patterns include:

• firstname@company.com
• firstname.lastname@company.com
• f.lastname@company.com
• flastname@company.com
• firstname_lastname@company.com

If you can find any other email address at the organisation, you know the pattern. Apply it to the name of the person you are trying to reach, then verify the result before you send anything.

This approach is more reliable than people give it credit for. It works well for mid-to-large organisations with consistent IT infrastructure. It is less reliable for smaller companies where email addresses may have been set up ad hoc, or for organisations that have gone through mergers and acquisitions and have mixed conventions.

Early in my agency career, before the current generation of lookup tools existed, pattern matching was essentially the only systematic method available. You found one address at a company, reverse-engineered the convention, and built from there. It is slower than a tool, but it gives you a higher degree of confidence in the result because you are working from a known data point rather than a probabilistic database match.

The Tools Worth Knowing About

Purpose-built email lookup tools have improved considerably over the past decade. Most work by aggregating publicly available data, crawling the web for email addresses associated with a domain, and applying pattern matching at scale. The better ones also include a confidence score or verification indicator.

Hunter.io is probably the most widely used in a professional context. You can search by domain to see all email addresses associated with a company, or search by name and domain to find a specific person. The free tier allows a limited number of searches per month. The paid tiers scale with volume. Hunter also has a verification function built in, which is worth using before you send.

Apollo.io is a more complete sales intelligence platform. It includes email lookup as part of a broader prospecting workflow, with data on company size, revenue, technology stack, and other signals that help you prioritise outreach. If you are doing outbound at any meaningful scale, the additional context Apollo provides is genuinely useful rather than just noise.

Snov.io covers similar ground to Hunter, with a Chrome extension that works directly in LinkedIn and on company websites. The extension approach is convenient if you are doing individual lookups as part of a prospecting workflow rather than bulk searches.

Clearbit (now part of HubSpot) is stronger on enrichment than raw lookup. If you have a partial record and want to fill in the gaps, it is a good option. It integrates cleanly with CRM systems, which matters if you are trying to keep your data hygiene in order.

RocketReach has broad coverage, particularly for senior contacts at larger organisations. It tends to be more expensive than the alternatives but the data quality at the upper end of the market justifies it for some use cases.

None of these tools is infallible. I have used most of them at various points and the honest assessment is that accuracy varies by sector, geography, and company size. The tools are best used in combination with verification rather than as a single source of truth.

Verification: The Step Most People Skip

Finding an address and verifying an address are two different things. Verification checks whether the address actually exists and can receive mail, without sending an email to it. This matters for two reasons: accuracy and deliverability.

On accuracy, a tool might return an address with 80% confidence. That sounds high until you are sending to a list of 500 contacts and 100 of them bounce. On deliverability, high bounce rates signal to email service providers that your list is low quality. That affects your sender reputation, which affects whether your emails land in the inbox or the spam folder, including for the contacts on your list whose addresses are correct.

Most of the major lookup tools include some form of verification. You can also use standalone verification services. NeverBounce, ZeroBounce, and Bouncer are all reliable options. If you are importing a list into a platform like Mailchimp, some platforms run their own verification checks at the point of import.

The process is straightforward: export your list, run it through a verification tool, remove anything flagged as invalid or risky, then import the cleaned list. It adds a step but it is not a complicated one, and the downstream benefit to your deliverability is significant.

When I was running the performance marketing team at iProspect, we were managing email programmes for clients across multiple sectors. The discipline around list quality was non-negotiable. A dirty list does not just waste spend, it actively damages the channel for future campaigns. That lesson transfers directly to outbound prospecting.

Using LinkedIn More Effectively

LinkedIn deserves its own section because it is where most professional prospecting starts, and it is frequently misused.

LinkedIn is not primarily an email lookup tool. It is a professional graph. Its value in this context is in helping you identify the right person to contact, understand their role and seniority, and find signals that make your outreach more relevant. The actual email address usually has to come from somewhere else.

That said, there are a few ways LinkedIn can get you closer to an address. First, if you are connected with someone, their contact information tab sometimes includes an email address they have chosen to make visible. It is worth checking before you go elsewhere. Second, LinkedIn Sales Navigator includes some email data, though its coverage is inconsistent. Third, the Chrome extensions for tools like Snov.io and Apollo work directly on LinkedIn profiles, pulling email data from their databases as you browse.

LinkedIn InMail is also worth mentioning as an alternative to email outreach entirely. If you cannot find a verified address, a well-crafted InMail to the right person can be as effective as a cold email, sometimes more so because the context of the platform signals professional intent. The response rates are lower than email on a per-message basis, but the quality of the contact is often higher because you are reaching people in a professional mindset.

The broader point about personalisation in email and social outreach is covered well in Buffer’s analysis of personalisation in email marketing, which is worth reading if you are thinking about how to make your outreach land once you have the address.

The WHOIS Method and Its Limits

WHOIS records are the registration data associated with a domain name. Historically, they included the email address of the domain registrant, which was often the business owner or a senior contact at the organisation. You could look up a domain, find the registrant’s email, and have a direct line to the decision maker.

GDPR and equivalent privacy regulations have largely closed this off. Most domain registrars now redact personal contact information from public WHOIS records, replacing it with a proxy address or removing it entirely. WHOIS is still useful for identifying who owns a domain and when it was registered, but it is no longer a reliable source of personal email addresses in most jurisdictions.

For US-based targets, some registrars still show contact information for business registrations. It is worth a check, but do not rely on it as a primary method.

Google Search Operators: Still Useful, Still Underused

Google’s advanced search operators can surface email addresses that are publicly indexed but not immediately obvious. A few combinations worth knowing:

• site:company.com “@company.com” , searches the company’s own domain for any pages containing email addresses in that format
• “firstname lastname” “@company.com” , looks for any indexed page that mentions both the person’s name and an email address at their company
• “firstname lastname” email contact , broader search that might surface bios, speaker pages, or directory listings

These are not guaranteed to return results, but they cost nothing and take seconds. If the address is publicly indexed anywhere, this approach will often find it. It is particularly effective for people who have a public-facing professional presence: speakers, authors, consultants, and anyone who has been featured in industry media.

When to Ask Directly

This sounds obvious but it is genuinely underused. If you have a mutual connection, ask them to make an introduction or pass on the contact’s email. If you have interacted with someone on social media or at an event, ask them directly for the best way to reach them. Most professionals will respond positively to a direct, honest request, particularly if you have a credible reason for reaching out.

The alternative, spending twenty minutes trying to find someone’s email address through indirect means, is sometimes less efficient than a thirty-second message on LinkedIn saying you would like to send them something and asking for the best address to use. It also starts the relationship on a more transparent footing, which matters if you are trying to build something rather than just send a one-off message.

I have closed agency business through introductions that started exactly this way. A mutual contact, a direct ask, a warm introduction. The mechanics of email lookup are useful when you have no other route in. When you do have a route in, use it.

Data Protection and Compliance: What You Need to Know

Finding someone’s email address is one thing. Using it is subject to legal constraints that vary by jurisdiction and use case.

In the UK and EU, GDPR applies. Sending unsolicited marketing emails to individuals requires either their consent or a legitimate interest basis, and legitimate interest has conditions attached to it. B2B email to business addresses is treated differently from B2C email to personal addresses, but it is not a free pass. You need a genuine reason to contact the person, the outreach needs to be relevant to their professional role, and you need to make it easy for them to opt out.

In the US, CAN-SPAM sets the rules for commercial email. It is less restrictive than GDPR on the consent side but has its own requirements around identification, opt-out mechanisms, and physical address disclosure. Canada has CASL, which is closer to GDPR in its consent requirements and is often underestimated by US-based senders who assume North American rules are uniform.

The practical upshot is that cold email to professional contacts is generally permissible in most jurisdictions if it is relevant, honest about its commercial nature, and easy to opt out of. Mass unsolicited email to personal addresses, or any email that misrepresents its origin or purpose, is not. The line between legitimate prospecting and spam is real, and it is enforced.

If you want a deeper grounding in email as a channel, including the compliance dimension and how it fits into a broader acquisition strategy, the Email and Lifecycle Marketing hub covers it in full.

What to Do Once You Have the Address

Finding the address is the easy part. The harder part is writing something worth reading when you get there.

Cold email works when it is specific, brief, and relevant. It fails when it is generic, self-promotional, or structured around what you want rather than what the recipient might find useful. The single most common mistake I see in agency new business emails is that they lead with the agency’s credentials rather than with a reason the recipient should care. Nobody reads a cold email to learn about your award wins.

A few principles that hold up across contexts. Keep it short. Three to four sentences is often enough to establish relevance and prompt a reply. Be specific about why you are contacting this person rather than anyone else. Make the ask clear and easy to act on. And follow up once, not five times.

HubSpot has a set of new business email templates for agencies that are worth looking at, not necessarily to copy, but to see the structural logic of what makes a cold email work. The best ones are notable for what they leave out as much as what they include.

The question of whether cold email is worth the investment at all is a fair one. Copyblogger’s perspective on email marketing’s continued relevance is a useful counterpoint to the narrative that social and messaging platforms have made email obsolete. Email is not dead. But it requires more craft than it used to.

If you are thinking about how email fits into a wider acquisition and retention strategy, Moz’s piece on email lists and SEO is a good read for understanding the channel relationships involved. And for the newsletter angle specifically, Moz’s Whiteboard Friday on email newsletter strategy covers the fundamentals in a practical way.

Putting It Together: A Practical Workflow

If you are approaching this systematically rather than as a one-off search, a consistent workflow saves time and produces better results.

Step one: Identify the right person. LinkedIn is the most efficient tool for this. You are looking for the person with the authority and relevance to respond to what you are sending, not just anyone at the organisation.

Step two: Check public sources first. Company website, social profiles, press releases, event listings. If the address is publicly available, you do not need a tool.

Step three: Use pattern matching. Find any email address at the organisation and reverse-engineer the naming convention. Apply it to your target.

Step four: Use a lookup tool. Hunter, Apollo, Snov.io, or whichever fits your workflow. Cross-reference the result against your pattern-matched address. Agreement between two methods increases confidence.

Step five: Verify before you send. Run the address through a verification tool. Do not skip this step if deliverability matters to you.

Step six: Write something worth reading. All of the above is wasted if the email itself is generic or poorly targeted. The address gets you in the door. The email determines whether you get a response.

The whole process, done properly, takes longer than typing a name into a single tool and hitting send. It also produces better results. That trade-off is worth making.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions