You've identified the perfect prospect. Now you need their email address — and guessing wrong means bounces that damage your sender reputation.
Here are the seven methods that actually work in 2026, ordered by reliability.
1. Use a B2B lead database (fastest, most reliable)
Purpose-built databases aggregate and verify contact data at scale. Search by name, company, industry, or location and unlock a verified address in seconds.
- LeadQuasar covers 7 million+ contacts across 180+ industries, each with a quality score so you know how complete a record is before you pay. Searching is free; unlocking a verified contact costs a few credits.
- This beats manual methods on volume: building a 200-contact list takes minutes, not days.
When to use: any time you're prospecting more than a handful of people.
2. Guess the email pattern (free, surprisingly effective)
Most companies use one pattern for everyone. If you know one employee's email, you know them all:
| Pattern | Example |
|---|---|
| first@domain | sarah@acme.com |
| first.last@domain | sarah.chen@acme.com |
| flast@domain | schen@acme.com |
| firstl@domain | sarahc@acme.com |
Find the pattern from press releases, "contact us" pages, or any teammate's published address — then apply it to your prospect. Always verify before sending (method 7).
3. Check the company website
- About / Team pages often list direct emails for leadership.
- Contact pages at smaller companies frequently publish the owner's address.
- Legal/privacy pages sometimes include a compliance contact that reveals the domain pattern.
Small local businesses (dentists, law firms, contractors) are the exception — many publish only a phone number, which is why phone-first outreach works better there (see our data study).
4. LinkedIn (contact info + content clues)
- The Contact info section on a profile sometimes lists an email — especially for founders and salespeople who want to be reached.
- People often share their email in posts ("DM me or email me at…"). Search
site:linkedin.com "name" "email"variations. - LinkedIn is also the fastest way to confirm someone still works where you think they do — stale employment data is the #1 cause of bounces.
5. Google operators (the classic)
Try these searches:
"firstname lastname" email @company.com
"firstname lastname" contact site:company.com
"@company.com" "sales" OR "marketing"
You're looking for conference speaker pages, PDFs, press releases, and directories that published the address.
6. Check GitHub, personal sites, and podcasts
For technical or founder prospects:
- GitHub commits often expose a public email (
github.com/username→ repos → commit history). - Personal blogs and portfolio sites usually have a contact address.
- Podcast show notes frequently include a guest's contact info.
7. Always verify before sending (non-negotiable)
However you found the address, verify it:
- Bounce risk: sending to invalid addresses above ~2–3% poisons your domain reputation and lands future emails in spam.
- Verification checks the mailbox exists (SMTP handshake) without sending anything.
- Databases like LeadQuasar show verification status on each email up-front; for pattern-guessed addresses, run them through a verifier first.
Quick decision guide
| Situation | Best method |
|---|---|
| Building a list of 50+ prospects | Lead database |
| One high-value prospect | Pattern guess + verify |
| Technical founder | GitHub / personal site |
| Local business owner | Database (phone-first) or website |
| Already know a teammate's email | Pattern guess + verify |
Frequently asked questions
Is it legal to find and email someone's business email?
B2B outreach to work addresses is legal in most jurisdictions when you comply with applicable law — CAN-SPAM in the US (honest subject lines, opt-out honored), and legitimate-interest requirements under GDPR in the EU. Personal addresses are riskier territory; stick to business emails.
What's the success rate of guessing email patterns?
With the correct first/last name and the company's known pattern, accuracy is typically 70–90% — but always verify, because the exceptions (duplicate names, legacy formats) are exactly what causes bounces.
How do free email finders compare to paid databases?
Free finders usually ration a few lookups per month and skip verification. That's fine for occasional use; for consistent prospecting, per-contact credit pricing ends up cheaper than the time cost of manual hunting — and protects your sender reputation.
Skip the hunting: search 7 million+ verified contacts free and unlock emails only when you need them.