Finding a specific person's email address is one of the most common - and most frustrating - tasks in sales, recruiting, journalism, partnerships, and PR. The good news: in most cases the address is out there, and there are eleven proven techniques that, used in combination, will find almost any work email on the public internet.
This guide walks through each method, from the simplest (asking directly) to the most technical (WHOIS lookups, email pattern inference, and dedicated finder tools). Pair anything you find with a verifier like Proofy's email finder so you're not sending to addresses that bounce.
Why Getting the Right Email Address Matters
Sending the right pitch to the wrong address is the same as not sending it at all. Worse, sending to a string of bad addresses signals spammer behavior to inbox providers, tanks your sender reputation, and starts impacting deliverability across your entire list. Sender reputation compounds - a clean list outperforms a 2x larger dirty list within a few weeks.
The other reason finding the right address matters: response rates. A correctly addressed message to a relevant contact is the difference between a 5% reply rate and a 30% one. The work you put in finding the right person is the highest-leverage step in the whole outreach process.
11 Practical Methods to Find Someone's Email Address
1. Just ask
The simplest method is almost always the most overlooked. If you have any line of contact - Twitter, LinkedIn, a mutual contact, a meeting, a published phone number - ask. People will give you their email if you give them a clear, brief reason to. A polite DM with "What's the best email to reach you on for [specific topic]?" works far more often than people expect.
2. Google search with operators
Search for "first last" + email + company.com on Google. Add operators like site:linkedin.com, site:twitter.com, or "@company.com" to narrow results. Many professional emails are sitting in public PDFs, conference attendee lists, GitHub commits, or old press releases - Google indexes all of them.
3. LinkedIn and business networks
LinkedIn profiles often list a personal email under "Contact Info" (the person has to expose it deliberately, but many do). Sales Navigator and similar tools give wider visibility. AngelList, Crunchbase, and industry-specific networks (GitHub for engineers, Dribbble for designers, Behance for creatives) are equally valuable for niche searches.
4. The target's company website
Check the About, Team, Leadership, and Contact pages. Many companies list executive emails directly. Press pages and media contact sections often expose senior contacts. Career pages sometimes reveal recruiter emails. Footer contact forms occasionally hide the underlying address in the page source.
5. Pattern guessing from domain conventions
Most companies follow a consistent email pattern: first.last@company.com, flast@company.com, first@company.com, or firstinitial+last@company.com. If you know any one employee's email at the target company, you almost certainly know the pattern for everyone else. Combine this with verification to confirm the guess.
6. Social media beyond LinkedIn
Twitter bios, Facebook About sections, Instagram contact buttons, and YouTube channel descriptions all sometimes expose direct email contact. For public-facing professionals (journalists, executives, creators), the email is often deliberately listed.
7. Personal website or blog
Anyone who maintains a personal site usually exposes a contact email - it's the whole point of having the site. Check the About page, the footer, and any "Hire me" or "Contact" sections. For writers and consultants, this is the fastest path.
8. WHOIS domain lookup
If the person owns a domain, WHOIS records may list a registrant contact email. Privacy services hide this on most consumer domains, but business and older domains often still expose it. Tools like whois.com and icann.org/lookup work for one-off queries.
9. Dedicated email finder tools
Tools like Hunter, Apollo, Snov.io, RocketReach, and Lusha specialize in this. They combine pattern inference, public scraping, and proprietary databases, and most include a verification step. See our roundup of the best email finder tools for a comparison of free and paid options.
10. Sign up for the person's newsletter or content
If the target writes a newsletter, hosts a podcast, or publishes a Substack, subscribe and reply to one of their issues. The reply lands directly in their inbox and you've now had a legitimate first interaction - which is a stronger position than cold prospecting from a found address.
11. Twitter advanced search
Twitter's advanced search (twitter.com/search-advanced) lets you find tweets that contain a specific email address or "@" pattern. People mention their own emails in support threads, account-recovery requests, and contact-me tweets far more often than you'd expect.
A bonus method worth considering: cross-reference results from two finders. If a company email-finding workflow and a name-based search both return the same address, your confidence should be near-certain. Divergent results mean you need to verify before sending.
Common Mistakes When Trying to Find an Email Address
- Sending to a guessed address without verifying. Pattern guessing is usually right, but the 10-20% it gets wrong becomes 10-20% hard bounces. Always verify before sending - even one round of bounces on a fresh sending domain can take weeks to recover from.
- Trusting the first result from a single tool. No finder has perfect coverage. If a tool returns "found" for one address and you stop searching, you may have a stale or low-confidence result. For high-value targets, cross-check across two sources.
- Ignoring catch-all domains. Some companies accept mail to any address at their domain, so a guessed address may "verify" without actually reaching a person. Catch-all is a yellow flag, not a green one.
- Buying email lists. Purchased lists are the single fastest way to destroy a sending reputation. They usually contain spam traps, role addresses (info@, sales@), and addresses harvested without consent. List cleaning on a purchased list typically removes 30-50% of records, and the survivors still underperform.
- Skipping personalization once you find the address. The finder gives you the inbox; what you send is what determines whether you get a reply. A generic message to a verified email beats a personalized one to a wrong address, but a personalized one to a verified email beats both.
- Forgetting that emails go stale. Roughly 20% of professional emails become inactive each year as people change jobs. If you found an address six months ago, re-verify before reusing it.
Frequently Asked Questions
Is it legal to find someone's email address?
Yes, in most jurisdictions, when you're sourcing business contact information from public sources and using it for legitimate business outreach. Privacy laws like GDPR and CCPA still apply: you need a legitimate-interest basis, your message has to be relevant to the recipient's professional role, and you need to honor opt-out requests immediately.
What's the fastest way to find someone's email?
If you have a name and a company domain, a dedicated email finder tool returns a result in seconds. If you don't want to pay, the combination of LinkedIn + pattern guessing + free-tier verification covers most cases in a couple of minutes.
How can I verify the email address is correct?
Run it through an email verifier. A verifier performs syntax checks, MX record lookups, and SMTP probing to confirm the address is live and accepting mail. Pair finding with verification as a single workflow rather than two separate steps.
Are free email finders accurate?
Free tiers typically hit 70-85% accuracy on US/European B2B contacts, lower for other regions and for older or junior employees. Paid tools push that into the 90%+ range. For occasional one-off lookups, stacked free tiers are usually sufficient.
What do I do if no method returns an email?
Try a different angle - reach out on LinkedIn, find their company's general inquiries email, or contact a colleague who can forward you. Some people deliberately keep their email private; in that case, the right path is to ask permission rather than guess.
How often should I re-verify a contact list?
Quarterly is a reasonable baseline. Lists in high-turnover industries (tech, marketing, consulting) decay faster - re-verify monthly if you're sending regularly. See how bounces affect deliverability for the full reasoning.
What to Do Once You've Found the Address
Finding the address is step one. Before you send anything, run the result through verification - even high-confidence finder results return some percentage of bad addresses, and a single bounce on a freshly warmed sending domain damages deliverability for weeks. For one-off lookups, a tool like verification software handles a single address in a few seconds. For bulk imports (50+ addresses), upload the CSV to a bulk verifier and clean the list before importing into your sending platform.
Then, before the first send, set realistic expectations: even with a clean list and the right contact, cold email reply rates of 5-15% are normal for B2B. Personalization, relevance to the recipient's current role, and a clear, specific ask are what push that number higher.
Finding the right email address is part skill, part patience, part tooling. Combine two or three of the methods above, verify the result before sending, and personalize the message to the person on the other end. That sequence - find, verify, personalize - is the foundation of every successful outreach program.
