How to Find Anyone's Email Address (7 Proven Methods)

Last month I was trying to reach the VP of Sales at a 200-person SaaS company. I knew his name. I knew his company. I'd even watched him on a podcast talking about their GTM motion. But I couldn't find his email anywhere.

LinkedIn InMail? He hadn't checked his inbox in weeks (classic). Company website? Generic info@ address with a contact form that goes to a black hole. So I did what I always do—I worked through every method I've learned over the past decade of building prospecting tools and running outbound myself.

Fifteen minutes later, I had his valid email, and the following week we were on a call.

Here's the thing: finding someone's email address isn't hard once you know the right approaches. But most guides online either list five obvious methods that barely work, or they're thinly-veiled product pitches. I'm going to be straight with you—I built LeadMagic's Email Finder, so I obviously think it's the best option. But I'm also going to walk you through six other methods that don't require any tool at all, because sometimes you just need to get scrappy.

7 Methods to Find Someone's Email Address

These are ordered from most reliable to least reliable, based on how often each method actually produces a valid, deliverable email.

Method 1: Use an Email Finder Tool

Reliability: High | Speed: Seconds | Cost: Varies (free trials available)

This is the fastest path from "I need this person's email" to "I have it." You plug in a name and a company (or a LinkedIn URL), and the tool returns a valid email address.

The catch is that not all email finder tools are created equal. Accuracy varies wildly—from 85% to 97%—and that gap matters more than you'd think. A 15% bounce rate will actively damage your sender reputation, which means your future emails start landing in spam even when you do have the right address.

Here's a real example. I needed the email for a Director of RevOps at a mid-market fintech company. I ran his name through three different tools:

• LeadMagic: Returned a valid email in 2 seconds. Email delivered.
• Hunter.io: Returned an email. It bounced—turned out to be an old format the company had migrated away from.
• Apollo: Returned a "verified" email. Also bounced. Apollo's database had the person at their previous company.

This is pretty typical, honestly. LeadMagic's Email Finder runs a 5-layer validation pipeline before returning a result—MX check, SMTP verification, catch-all resolution, deliverability scoring, and format validation. Unlike other tools that return an ambiguous "catch-all" status, LeadMagic resolves catch-all emails to a definitive "valid" or "not found." We don't charge you for results we can't verify. Most other tools return whatever they have in their database and call it "verified."

If you want a detailed comparison, I broke down the full landscape in Best Email Finder Tools in 2026.

When to use this: When you have a name and company, and you need a valid email fast. This is the right default for any B2B prospecting workflow.

Limitations: Tools cost money (though LeadMagic plans start at $59.99/mo with no annual lock-in). Coverage can be thin for very small companies or people who have minimal online presence.

Method 2: Check the Company Website

Reliability: Medium | Speed: 2–5 minutes | Cost: Free

Before you reach for any tool, spend 60 seconds on the company's website. You'd be surprised how often the email you need is just sitting there in plain text.

Here's where to look:

• Contact page — Sometimes lists department emails or individual contacts
• About/Team page — Startup and agency sites frequently list team members with email links
• Footer — Many smaller companies put a direct email in the site footer
• Press/Media page — PR contacts are usually listed with direct emails
• Job postings — The "apply to" email sometimes reveals the naming pattern

For example, if you find sarah.jones@company.com on their careers page, you now know the company uses firstname.lastname@company.com. That pattern applies to everyone else at the company.

When to use this: Always do a quick check before paying for a lookup. It takes 60 seconds and costs nothing.

Limitations: Most enterprise companies only show generic addresses like sales@ or support@. This works best for companies under ~500 employees.

Method 3: LinkedIn Profile Enrichment

Reliability: High | Speed: Seconds | Cost: Tool-dependent

LinkedIn is the world's biggest professional directory, and enrichment tools can extract verified contact info directly from a LinkedIn profile URL.

With LeadMagic's Profile Search, you paste in a LinkedIn URL and get back the person's valid work email, phone number, company data, and more. It's the closest thing to a "one-click answer" that exists.

Here's the workflow I use:

1. Find the person on LinkedIn
2. Copy their profile URL
3. Paste it into LeadMagic's Profile Search
4. Get their valid email, phone, and company details

This is particularly powerful because LinkedIn profiles tell you where someone currently works, which means the email you get back is current—not some stale record from a database that hasn't been updated in 18 months.

You can also do this in bulk. If you have a list of 500 LinkedIn URLs (exported from Sales Navigator, for example), you can enrich the whole list through our API or CSV upload and get back valid emails for the entire batch.

When to use this: When you have a LinkedIn URL and want the highest-confidence result possible. Great for account-based selling where you're targeting specific people.

Limitations: Requires the person to have a LinkedIn profile (which, in B2B, is basically everyone). Cost per lookup varies by tool.

Method 4: Google Advanced Search Operators

Reliability: Medium | Speed: 5–10 minutes | Cost: Free

Google indexes an absurd amount of the internet, including email addresses that people have published in conference talks, comment threads, regulatory filings, and company directories. The trick is knowing the right search operators.

Here are the searches I use, with a real example. Let's say I'm looking for the email of someone named "David Chen" who works at "Acme Corp":

Search 1: Direct email search

"David Chen" "Acme Corp" email

Search 2: Site-specific search

site:acmecorp.com "David Chen"

Search 3: Email pattern search

site:acmecorp.com "@acmecorp.com"

This one won't find David specifically, but it'll reveal the email format the company uses. If you find jsmith@acmecorp.com, you can guess dchen@acmecorp.com.

Search 4: File-based search

"David Chen" "@acmecorp.com" filetype:pdf

Conference presentations, whitepapers, and regulatory filings often include email addresses in PDF documents.

Search 5: Social + email combo

"David Chen" "Acme Corp" ("email" OR "contact" OR "reach me at")

I used this exact technique last year to find the email of a CTO at a cybersecurity startup. His email wasn't on the company website, but it showed up in a PDF of a talk he gave at BSides. Took about 8 minutes of searching.

When to use this: When the email finder tools come up empty—usually for people at very small companies, academics, or niche industries.

Limitations: Time-consuming. Only works if the person's email has been published somewhere that Google has indexed. Hit rate is maybe 30-40%.

Method 5: Email Pattern Guessing + Verification

Reliability: Medium-High | Speed: 5–10 minutes | Cost: Free to find, small cost to verify

About 90% of companies use one of these five email formats:

• firstname.lastname@company.com — most common
• firstname@company.com
• flastname@company.com
• firstnamelastname@company.com
• f.lastname@company.com

If you know which format a company uses, you can construct anyone's email at that company.

Here's how I do it:

Step 1: Find the company's email format. Search Google for @company.com and see if any emails show up in press releases, blog comments, or public directories. Even one example tells you the pattern.

Step 2: Construct the email. If you found that the company uses firstname.lastname@, just plug in the name of the person you're looking for.

Step 3: Verify before sending. Don't just guess and blast. Use an email verification tool to confirm the address exists. LeadMagic's Email Validation will tell you if the email is deliverable, risky, or invalid. Sending to unverified guesses is how you tank your sender reputation.

I once needed to reach a COO at a healthcare company. A quick Google search for @theircompany.com turned up a press release with the CEO's email: m.rodriguez@theircompany.com. So I tried j.park@theircompany.com for the COO (Jennifer Park). Ran it through email validation—confirmed deliverable. Sent the email. Got a response within two hours.

When to use this: When you can find at least one email from the company to establish the pattern. Works particularly well for mid-market and enterprise companies that use consistent naming conventions.

Limitations: Fails for companies with catch-all domains (you'll think the email is valid when it might not be). Also fails when people have common names and the company has already used that email address for someone else. Always verify.

Method 6: Social Media Bios and About Pages

Reliability: Low-Medium | Speed: 5–10 minutes | Cost: Free

Some people just... put their email on the internet. Especially founders, freelancers, journalists, and developer advocate types. Check these places:

• X/Twitter bio — Surprisingly common, especially for founders and journalists
• GitHub profile — Developers frequently list their email in their profile or commit history
• Personal website/blog — Many professionals have a personal site with contact info
• YouTube About section — Content creators and thought leaders list contact emails
• Substack/newsletter — Writers often include their email in their about page
• Podcast show notes — If they've been a podcast guest, the show notes might include their contact
• Crunchbase — Founder profiles sometimes include direct email addresses

This method is manual and slow, but it's free and sometimes surfaces emails that no tool has in its database. For people with a strong personal brand, it's often faster than you'd expect.

When to use this: For founders, creators, journalists, or anyone with a public persona. Not great for rank-and-file employees at big companies.

Limitations: Only works if the person has actively published their email somewhere public. Hit rate varies wildly—maybe 20% for random B2B contacts, but 60%+ for founders and content creators.

Method 7: Industry Directories, Conference Speakers, and Podcast Guests

Reliability: Low-Medium | Speed: 10–20 minutes | Cost: Free

This is the deep-research method. It's slower, but it can surface emails that nothing else will find.

Industry directories and associations: Many industries have member directories that list contact information. Think bar associations, medical boards, accounting societies, tech community directories, and trade associations. If your target is a licensed professional, their regulatory body probably has their contact info on file.

Conference speaker lists: If someone spoke at a conference, their email is often in the speaker directory—either on the conference website or in the archived program PDF. Search "person's name" speaker 2025 OR 2026 and you'll frequently find their bio page with an email listed.

Podcast appearances: Same principle. Podcast show notes often include a guest's preferred contact method. Search "person's name" podcast and scan the results.

WHOIS records: If the person owns a domain, the WHOIS record might still have their contact information (though privacy services have made this less reliable in recent years).

SEC filings: For executives at public companies, SEC filings sometimes include direct contact information in the cover pages.

Patent filings: Engineers and scientists who hold patents may have their contact information in the filing.

I used the conference-speaker method to find the email of a VP of Engineering at a Series C startup. She'd spoken at a DevOps conference six months earlier, and the speaker page had her direct email. The whole process took about 12 minutes.

When to use this: When all other methods have failed, or when you're targeting someone in a regulated industry with public directories.

Limitations: Very time-intensive. Not scalable. Only useful for one-off high-value targets where you're willing to invest the research time.

Which Method Should You Use?

Here's my decision framework, simplified:

Do you have a name + company (or LinkedIn URL)? → Start with an email finder tool. It's the fastest and most reliable path. If LeadMagic returns a result, you're done in seconds.

Tool came back empty? → Check the company website (Method 2). Takes 60 seconds.

Still nothing? → Try Google advanced search operators (Method 4) and email pattern guessing (Method 5) in parallel. Between these two methods, you'll cover most cases.

Targeting a founder, creator, or public figure? → Jump straight to social media bios (Method 6). Founders especially tend to make their email findable.

High-value target you really need to reach? → Break out the deep research: conference speakers, directories, podcast appearances (Method 7).

Need to do this at scale (50+ contacts)? → Skip the manual methods entirely. Use LeadMagic's Email Finder or Profile Search in bulk. Upload a CSV, get valid emails back. Manual methods don't scale, and your time has a cost.

For personal email addresses (reaching someone outside their corporate inbox), we built a separate Personal Email Finder that's specifically designed for that use case.

Common Mistakes People Make

After watching thousands of customers go through this process, I see the same mistakes repeatedly.

Sending to unverified emails

This is the biggest one. You find what looks like a valid email through guessing, a directory, or an old database—and you just add it to your sequence without verifying it. Bad idea. Even a 5% bounce rate will start damaging your sender reputation within a few hundred sends. Always run emails through a verification tool before sending.

Trusting "verified" labels from cheap tools

Not all verification is equal. Some tools mark an email as "verified" after only checking if the domain has an MX record. That tells you almost nothing. Proper verification includes SMTP handshake testing, catch-all detection, and deliverability scoring. If your tool doesn't explain what "verified" means, it probably means "we checked the bare minimum."

Using outdated data

People change jobs. Companies rebrand. The email that was valid six months ago might bounce today. If you're working from a purchased list, a downloaded CSV from an old project, or saved leads from a CRM that hasn't been enriched recently, re-verify before you send. Job-change rates in B2B are running around 30% annually, which means roughly a third of your contact data goes stale every year.

Ignoring catch-all domains

About 30% of B2B domains are configured as "catch-all"—meaning the server accepts any email sent to that domain, even if the specific inbox doesn't exist. Standard email verification can't tell you if john@catchalldomain.com is a real person. Most tools return an ambiguous "catch-all" status and leave you guessing. LeadMagic's Email Finder actually resolves catch-all emails—using pattern analysis, historical data, and secondary signals to return a definitive "valid" or "not found" instead of punting with an inconclusive status.

FAQ

Is it legal to find and email someone without their permission?

In the US, the CAN-SPAM Act allows you to send unsolicited commercial email as long as you include a physical address, a clear opt-out mechanism, and don't use deceptive subject lines. You don't need prior permission. In Europe, GDPR requires a "legitimate interest" basis for B2B outreach—which generally covers relevant business communication, but you need to document your basis and honor opt-out requests immediately. Check out our guide on GDPR-compliant prospecting for the full breakdown.

What's the difference between a work email and a personal email?

A work email is tied to a company domain (e.g., name@company.com) and is the standard target for B2B outreach. A personal email uses a consumer provider like Gmail, Outlook, or Yahoo. Most email finder tools return work emails by default. If you specifically need a personal email—for recruiting, investor outreach, or reaching someone who's between jobs—LeadMagic has a dedicated Personal Email Finder for that.

How accurate are email finder tools?

It varies enormously. In our testing of 500 real B2B prospects, accuracy ranged from 85% (Apollo) to 97% (LeadMagic). The difference comes down to validation depth—some tools just check if a domain exists, while others run full SMTP verification, catch-all analysis, and deliverability scoring. I covered this in detail in Best Email Finder Tools in 2026.

Can I find emails in bulk?

Yes, and if you need more than a handful of emails, you should. Manual methods don't scale. Most email finder tools—including LeadMagic—let you upload a CSV with names and companies (or LinkedIn URLs) and get valid emails back in minutes. You can also use our API to integrate email finding directly into your CRM, Clay workflows, or custom enrichment pipelines.

Why do my emails keep bouncing even with a "verified" email?

Three likely causes: (1) The tool's verification was shallow—MX-record-only checks miss a lot. (2) The email was valid when it was found but the person has since left the company. (3) The domain is catch-all, and the tool marked it as valid without proper catch-all analysis. Switch to a tool that does real-time SMTP verification and catch-all detection, and re-verify any emails that are more than 30 days old before sending.