To find someone's email address, you have four working methods: an email finder tool (fastest), permutation plus verification (the reliable manual route), LinkedIn and company-site research, and public sources like mailto links or WHOIS records. Whichever you use, the job always ends the same way — verify the address before you send, so you never bounce a message off a guess.
For a business email the inputs are always the same two things: the person's full name and their company's email domain. Below we compare every method and when each fits, then walk through the full manual workflow step by step. Either way the rule is the same — find, then verify.
What Are the Best Ways to Find Someone's Email Address?
The best ways to find someone's email address are an email finder tool, permutation plus verification, LinkedIn and company-site research, and public sources such as mailto links, WHOIS records, and indexed documents. They differ in speed, cost, and accuracy — here is each method and when it fits.
1. Use an email finder tool
An email finder takes a name and company and returns the work email in one step: it matches the person to their current role, works out the company's format, and — with the better tools — verifies the address before handing it over, so you get a confirmed mailbox rather than a scored guess. We compare the field in our roundup of the best email finder tools.
Best when: you have a prospect list, or you want a deliverable address without doing the format detective work yourself.
2. Permutation plus verification
The reliable manual route, and the one this guide walks through in full below. A free email permutator generates every likely format from the name and domain, then email verification checks the candidates against the mail server — usually exactly one comes back valid. Generating is free; verifying is the paid step that makes the result trustworthy.
Best when: you have a handful of lookups and want control of — and visibility into — every step.
3. LinkedIn and company-site research
LinkedIn rarely hands you the email itself — the Contact info section only shows an address if the person chose to share one, and most professionals don't. Its real value is nailing the inputs: current employer, exact role, and full name. The company's own site fills in the rest — team and about pages, press releases, and newsletter footers often expose a staff address that reveals the email format for everyone else.
Best when: you need to confirm the right employer and role before building the address — or your target is senior enough to appear in press material.
4. Public sources: mailto links, WHOIS, and indexed documents
Free, hit-or-miss sources worth a few minutes: mailto: links on personal sites and GitHub profiles, WHOIS records for the person's own domain, and documents Google has indexed — try site:company.com "@company.com" or a name plus filetype:pdf. One caveat: most registrars now redact WHOIS contact details behind privacy proxies, so the WHOIS route rarely pays off for company domains anymore.
Best when: your target is a founder, developer, or small-site owner who publishes their own contact details.
Every method: verify before you send
However you found the address — even copied from a website — run it through email verification before it goes in a send list. Published addresses go stale when people change jobs, and a permutated guess is only a guess until the mail server confirms it. How verification works is covered below.
| Method | Cost | Speed | Best for |
|---|---|---|---|
| Email finder tool | Paid (per valid email) | Seconds | Lists; verified-deliverable results in one step |
| Permutation + verification | Free to generate, paid to verify | Minutes | One-off lookups on a budget |
| LinkedIn / company site | Free | Slow | Confirming the right employer, role, and format |
| Mailto / WHOIS / documents | Free | Hit-or-miss | Founders, developers, small-site owners |
Accuracy note: no method is immune to catch-all domains — 40-60% of B2B domains accept mail for every address, so "the server didn't reject it" is not proof a mailbox exists. That's why the verification step below matters regardless of how you found the address.
How Do You Find an Email Address by Name?
You find an email address by name by reverse-engineering the company's email pattern. Almost every organization applies one consistent format to every employee — so once you know the pattern and the domain, a name is enough to build the address. The catch is that the pattern varies from company to company, which is why guessing a single format blind is unreliable.
The two things every email address is made of
- Name part — some arrangement of first name, last name, and initials (e.g.
john.doe,jdoe,john). - Domain — the company's email domain after the
@, usually the same as its website (e.g.company.com).
Nail the domain and the name part, and you've reconstructed the address. The whole method that follows is just a disciplined way to get both right — and to prove the result exists before you rely on it.
The most common corporate formats are [email protected] and [email protected], with [email protected] common at smaller firms. Because you can't assume one and be right, the reliable approach is to generate every plausible format with an email permutator and let verification pick the winner.
How to Find Someone's Email Address, Step by Step
To find someone's email address, get their name and company domain, generate the likely formats, then verify to find the one that exists. Here's the full workflow:
Get the full name
You need first and last name at minimum. A middle name or a known nickname helps — more inputs mean more accurate candidate formats. LinkedIn, the company team page, and conference speaker lists are reliable sources.
Find the company's email domain
Grab the domain from any existing staff email, the site's contact or press page, or an email signature. It's usually — but not always — the same as the website domain (some companies send from a dedicated mail domain).
Establish the company's format
A single public address reveals the pattern. If [email protected] appears in a press release, Acme almost certainly uses first.last for everyone. No public address? Permutate one known employee and verify to learn the pattern.
Generate the candidate addresses
Feed the name and domain into the free email permutator. It instantly returns 40+ likely formats. If you already know the company pattern, you only need the one address that matches it.
Verify before you use it
Run the candidate(s) through email verification. Exactly one (occasionally two) comes back valid — that's the real address. Never send to the whole guessed list.
Skip the guesswork
An email finder runs steps 3–5 for you: it works out the format, matches the person to their current role, and returns only the address it has confirmed deliverable — so you skip straight to a usable email.
Try the Email FinderHow to Find Someone's Work Email
To find someone's work email specifically, tie the person to the right employer first — then apply that company's format to their name. The trap with work emails is people who hold more than one role: a board seat, an advisory gig, a former company still on their profile. Build the address at the wrong domain and it will never land, no matter how good your format guess is.
Confirm the current employer
Check the person's current title and company, not just the top line of their profile. The domain you build against has to belong to the role you actually want to reach them about.
Reuse a proven pattern
Once you've confirmed one colleague's address at that company, every other employee almost certainly follows the same format. Apply it to your target with much higher confidence — but still verify.
Watch for catch-all domains
If verification says every guess is valid, you've probably hit a catch-all domain — one that accepts mail for any address — not a real match. 40-60% of B2B domains are catch-all, so this comes up constantly. Use a verifier that resolves individual mailboxes on catch-all domains.
This role-matching problem is exactly what a people search plus email finder solves automatically — the finder uses the role you searched to pick the right current company, so a domain only attaches when the role actually belongs to it.
How Do You Verify the Email You Found?
You verify a found email by checking it at the mail-server level — without ever sending a message. An email verification service runs three checks on each candidate:
Syntax & domain
Confirms the address is well-formed and the domain has valid MX (mail exchange) records that can receive email at all.
Mailbox existence (SMTP)
Connects to the mail server and asks whether the specific mailbox exists — via an SMTP handshake that stops short of delivering anything. This is what separates a real address from a dead guess.
Catch-all resolution
On catch-all domains that accept every address, standard checks report all your guesses as valid. Enrichley resolves individual mailboxes on catch-all domains so you still find the one address that's real.
Why you can't skip verification
Email a batch of unverified guesses and most will hard-bounce. Bounce rates above 2% flag you as a spammer to Gmail and Outlook, and a single spam-trap hit can blacklist your domain. Verifying first turns a reckless blast into one clean send.
Verify Your Found Addresses with Enrichley
- Confirms which candidate address actually exists
- 98% accuracy, including on catch-all domains
- Bulk CSV upload or real-time API — 1 credit per check
- Plans from $59/mo for 5,000 credits
Finding Email by Name at Scale
The manual method is fine for one or two contacts. For a whole prospect list, doing it by hand is slow and error-prone — this is where a finder earns its keep by collapsing "find the domain, guess the format, verify the result" into a single pass.
Start from a name
People Search covers 500M+ professionals and filters in real time by title, seniority, department, and company — so you can narrow to the exact people you need, each returned with a verified work email.
Pay only for valid emails
The Email Finder charges 3 credits per valid email — not-found, skipped, and errored lookups cost nothing. Every result is verified before it reaches you, catch-all included.
Weighing the manual route against dedicated software? Our roundup of the best email finder tools compares the options on price, credits, and — the part that actually decides deliverability — whether they return verified rather than guessed emails. And if you're building the target list itself, see how to find similar companies for lookalike prospecting — start from one account you win with and pull the decision-makers at every match.
Frequently Asked Questions
How do you find a business email address by name?
What is the fastest way to find someone's email address?
Can you find someone's email address on LinkedIn?
Can you find someone's email address for free?
How do you find someone's work email?
Is it legal to find someone's business email?
How accurate is guessing an email from a name?
What's the difference between an email finder and an email permutator?
Find the Name, Get the Verified Email
Skip the manual guessing. Search 500M+ professionals with People Search, then let the Email Finder return only addresses it has verified deliverable — you pay solely for the emails that check out.