Knowing how to find someone's work email is one of the most practical skills in B2B sales, recruiting, partnerships, and PR. The person you want to reach almost always has a work address, and it is usually discoverable in a few minutes if you know where to look. The hard part is not finding a plausible address. It is finding the right one, confirming it actually receives mail, and then using it in a way the recipient will not resent.
This guide walks through seven methods for finding a work email address, from free manual techniques to email finder tools, plus how to verify what you find and the etiquette that separates useful outreach from spam.
Before You Start: What You Need to Find Someone's Work Email
Almost every method below needs two pieces of information:
- The person's full name, spelled the way they spell it professionally. "Bob" might be "Robert" in the company directory.
- The company domain, not just the company name. "Acme" could be acme.com, acmehq.com, acme.io, or getacme.com. Check the company website and use the domain that appears in its own email links or contact page.
A LinkedIn profile URL is a useful third input. It pins down exactly which "Sarah Chen" you mean and confirms the current employer, which matters because a person's old work email stops working the day they leave.
If you are starting from a list of companies rather than people, read our guide on how to build a B2B prospect list with a lead database first, then come back here to find the addresses.
Method 1: Work Out the Company Email Pattern
Most organizations generate addresses from a consistent pattern. If you can find one real address at a company, you can usually infer the rest. The most common patterns are:
| Pattern | Example for Jane Doe at example.com |
|---|---|
| first.last | jane.doe@example.com |
| first | jane@example.com |
| firstlast | janedoe@example.com |
| flast | jdoe@example.com |
| firstl | janed@example.com |
| first_last | jane_doe@example.com |
| last.first | doe.jane@example.com |
Smaller companies and startups often use first name only. Larger companies lean toward first.last or flast, because first names collide quickly at scale. Our guide to professional email format covers why companies pick the formats they do.
How to find one real address at the company
- Look at press releases, which often list a media contact with a full name and email.
- Check blog author pages, speaker bios, and conference sessions.
- Search the company's public documents and PDFs, such as reports or partner guides.
- Look at job postings, which sometimes name the recruiter with a direct address.
- Search the web for the domain in quotes, for example "@example.com", to surface addresses that appear in public pages.
Once you see two or three real addresses that follow the same structure, you have a strong pattern. One address is weak evidence, because a single person might have a nonstandard alias.
The weakness of guessing
A pattern gives you a guess, not an answer. People with hyphenated names, duplicate names, middle initials, or nicknames break the rule. A guessed address must always be verified before you send to it (see Method 6).
Method 2: Check the Company Website
It sounds obvious, but the company's own site is often the fastest route, especially at small and mid-sized businesses.
- Team or About pages sometimes list emails directly, or link names to contact cards.
- Contact pages may show department addresses like hello@ or partnerships@. These are not personal work emails, but they confirm the domain and occasionally route to the right person.
- Footer and legal pages reveal which domain the company actually sends from.
- Blog posts and case studies often include an author email or a "reach out to" line.
For very small companies, a generic address like hello@ may be read by the founder directly. It is a reasonable fallback when nothing else works, but always prefer a named address when one exists.
Method 3: Use LinkedIn the Right Way
LinkedIn is the best place to confirm who someone is and where they currently work, which is half the battle. It is rarely the place you will see the actual address.
- Contact info section: some people list an email in their profile's contact info, visible to connections. If you are connected and it is shown, that is a clear signal the person is happy to be emailed there.
- Current employer: confirm the person still works at the company before you look up an address. Job changes are the single biggest reason a found email bounces.
- Profile URL: copy it. Many email finder tools accept a LinkedIn profile URL as input, which removes ambiguity about which person you mean.
Do not scrape LinkedIn or use browser extensions that harvest data in bulk. It violates LinkedIn's terms and can get your account restricted. We cover compliant workflows in detail in how to find an email from a LinkedIn profile.
Method 4: Search Engines and Public Footprints
People leave email addresses in plenty of public places related to their work:
- Conference speaker pages and event agendas
- Podcast show notes and guest bios
- Industry association member directories
- Open-source project pages and code commits (for technical roles)
- Academic papers and research profiles
- Their own personal website or newsletter signup page
Search for the person's name together with the company name and words like "email," "contact," or the domain. This works best for people with a public profile, such as founders, marketers, and engineers who publish. It works poorly for most mid-level managers, who rarely leave a public trail.
Method 5: Use an Email Finder Tool
When manual methods stall, or when you need addresses for more than a handful of people, an email finder is the efficient option. You give it a name plus a company domain or company name, or a LinkedIn profile URL, and it returns the most likely work email along with a confidence level.
What separates a good email finder from a mediocre one:
- Multiple data sources. No single source covers every company. Tools that check several sources in sequence, a technique called waterfall enrichment, tend to find more addresses.
- Built-in verification. The tool should confirm the mailbox exists before handing it to you, not just guess the pattern.
- Pay only for results. You should be charged for emails found, not for attempts. Lookups that miss should cost nothing.
- Caching. If you look up the same person twice, you should not pay twice.
- Bulk lookup. For a list of 200 prospects, you want to submit them all at once rather than one by one.
You can try a lookup with our free email finder tool. For a broader comparison of approaches, see our email lookup guide.
Method 6: Verify Before You Send
Whether you guessed the pattern or a tool returned an address, verify it before it goes into a campaign. Verification checks three things:
- Syntax: the address is correctly formed.
- Domain: the domain exists and has mail servers configured to receive email.
- Mailbox: the specific mailbox appears to exist on that server.
Results usually come back as valid, invalid, or "catch-all." A catch-all domain accepts mail for any address, so the verifier cannot confirm the specific mailbox. Treat catch-all results as medium risk: send to them in small numbers and watch bounces closely.
Why this matters: every hard bounce tells mailbox providers you are not careful about who you email. Keep hard bounces under roughly 2 percent, or your email deliverability suffers across every campaign, including mail to valid addresses. Our free email verifier and the guide on reasons to verify your email list go deeper.
Method 7: Ask for an Introduction or Use a Shared Contact
Sometimes the best way to find someone's work email is to ask someone who has it.
- A mutual connection can introduce you, which also raises the odds of a reply.
- A colleague of your target may happily forward your note or share the address if you explain why you are reaching out.
- Writing to a generic info@ or hello@ inbox with "Could you point me to the person who handles X?" works more often than people expect, especially at smaller companies.
This route is slower, but it produces the warmest first contact of any method.
Putting It Together: A Simple Workflow
For a single high-value contact:
- Confirm the person's current role and employer on LinkedIn.
- Find the company domain from its website.
- Run an email finder lookup using the LinkedIn URL or name plus domain.
- If nothing comes back, work out the company pattern from public addresses and generate a guess.
- Verify the address. Only send if it comes back valid, or carefully if it is catch-all.
For a list of 50 or more prospects:
- Build the list with names, titles, company domains, and LinkedIn URLs.
- Run a bulk email lookup across the whole list.
- Verify every found address.
- Remove invalid results and flag catch-all ones.
- Import the clean list into your CRM and outreach tool, deduplicating against existing contacts.
Etiquette: Finding the Email Is the Easy Part
An address you found is not an invitation to send anything you like. A few rules keep your outreach welcome and compliant.
- Use work emails for work topics. Contact someone at their work address about something relevant to their job. Do not hunt for personal addresses for B2B outreach.
- Explain the connection. Say briefly why you are writing to them specifically. Relevance is both good manners and the backbone of a legitimate interest basis under GDPR.
- Be brief and easy to decline. A short note with one clear ask respects their time.
- Include an opt-out and honor it. Every cold email should make it simple to stop hearing from you.
- Do not email-bomb a company. If you are contacting several people at one account, coordinate the timing rather than blasting everyone on the same day.
None of this is legal advice, but our cold email compliance guide covers CAN-SPAM, GDPR, and similar rules in more detail.
Finding Work Emails in ClickReach
ClickReach builds email finding into the same workspace as your CRM and email sequences. You can look up a work email from a LinkedIn profile URL or from a first and last name plus a company domain or name. The lookup checks several data sources, retries with another source when one misses, and refunds lookups that find nothing. Found emails are cached, so you never pay twice for the same person, and bulk lookup handles a whole list at once.
Once an email is found, the contact is linked to its company automatically, so you do not end up with duplicate accounts. The Pro plan is $50 per month for the whole team and includes 500 lead credits and 5,000 email verifications per month, with a found email costing about 1 credit. The 15-day free trial includes 30 credits. See the B2B lead database and pricing pages for details.
The Bottom Line
Learning how to find someone's work email comes down to a repeatable sequence: confirm who they are and where they work, get the right company domain, use a pattern or an email finder to get a candidate address, and verify it before you send. Manual methods are fine for a few contacts; for anything more, a multi-source email finder with verification saves hours and protects your sender reputation. Then use the address the way you would want yours used: briefly, relevantly, and with an easy way out.
