How to Find Anyone's Email Address in 2026 (7 Methods)
You know who you want to reach. You have their name and company. Now you need the email.
Here are the 7 methods I use, ranked by reliability. Start from the top. Only move down if the method above fails.
Method 1: Hunter.io Domain Search
Free Start here. Always.
Go to hunter.io, enter the company's domain name. Hunter will show you:
- The email pattern used by that company (firstname.lastname, first initial + last name, etc.)
- Verified emails it's already found from public sources
- Confidence score for each address
Once you know the pattern, construct the email yourself: if the pattern is first.last@company.com, then John Smith becomes john.smith@company.com.
Free limit: 25 domain searches/month. Enough for targeted prospecting. Upgrade if you need volume.
Success rate: ~70% find rate for companies with more than 10 employees (Hunter has usually scraped at least one email from those domains).
Method 2: LinkedIn + Email Pattern Inference
Free
LinkedIn shows you the person's full name and current company. Combine that with Hunter's domain pattern, and you're 90% of the way there.
Step-by-step:
- Find the person on LinkedIn
- Note their name exactly as they've written it (some people go by middle name, nickname, etc.)
- Get the company domain from their profile or their company's LinkedIn page
- Run domain through Hunter to get the email pattern
- Construct the email:
firstname.lastname@company.com - Verify with NeverBounce or ZeroBounce before sending
Pro tip: Check their LinkedIn bio. Some people list their email directly. Others list their personal website which has a contact page. You'd be surprised how often this works.
Method 3: Apollo.io Contact Lookup
Free tier
Apollo.io has a database of 275M+ contacts. Search by name + company and you'll often find the verified email directly.
Free plan gives you 50 email reveals per month — prioritize these for your highest-value prospects where you want to be 100% sure before you send.
Accuracy: Apollo's emails are generally 85-90% deliverable. The best accuracy I've seen across any tool at their price point.
Method 4: Google Search Operators
Free
Google has indexed billions of pages. Many of them have email addresses. The key is knowing how to search.
Effective search queries:
site:company.com "email" "@company.com"
"firstname lastname" "@company.com"
"firstname lastname" "company name" email
"firstname lastname" site:linkedin.com email
intext:"@company.com" "firstname"Also try searching for their press releases, speaking bios, and author pages on their blog — these often include direct email addresses for press or booking inquiries.
Success rate: ~35% for executives who have some public presence. Not reliable for middle management.
Method 5: Email Permutator + Verification
Free
If you know the name and domain but can't find the pattern, generate all possible combinations and verify which one exists.
The 12 most common B2B email patterns:
firstname@domain.com
lastname@domain.com
firstname.lastname@domain.com
f.lastname@domain.com
firstnamelastname@domain.com
flastname@domain.com
firstname_lastname@domain.com
lastnamefirstname@domain.com
lastname.firstname@domain.com
f_lastname@domain.com
firstinitial.lastname@domain.com
firstname-lastname@domain.comGenerate all 12, then run them through NeverBounce bulk verify (1,000 verifications free on signup). The one that comes back "valid" is the real email.
Important: Never send to all 12 variants. Spam detection systems flag duplicate content sent to multiple addresses on the same domain.
Method 6: Company Website Scraping
Free
Many companies list contact emails on their website — in footers, team pages, press pages, or "contact us" forms. Even if they don't list the individual email, they often list the format: "For sales inquiries, contact sales@company.com" — now you know the domain pattern.
Pages to check systematically:
/aboutor/team— often has individual emails or team photos with bios/contact— sometimes lists departmental emails/pressor/media— press contacts are almost always listed/careers— job postings sometimes have hiring manager emails- Blog post bylines — authors sometimes have contact emails in bios
Method 7: Snov.io, Findymail, or Kaspr
Paid (free tier available)
If the first 6 methods fail, these tools have their own proprietary databases and real-time email verification.
| Tool | Free Credits | Accuracy | Best For |
|---|---|---|---|
| Snov.io | 50/month | 83% | General B2B |
| Findymail | 10/month | 91% | Hard-to-find contacts |
| Kaspr | 5/month | 88% | European contacts |
| RocketReach | 5/month | 85% | Executives |
| Lusha | 5/month | 87% | US contacts + mobile |
Findymail is worth the tiny free tier for high-value contacts. It uses real-time SMTP verification rather than database lookups — much harder to fool.
The Verification Step You Can't Skip
"Every unverified email you send is a lottery ticket — 40% chance of a bounce that hurts your domain reputation."
Always verify before you send. The math is simple:
- 10% bounce rate = soft domain reputation hit
- 15%+ bounce rate = hard reputation hit, open rates drop, may trigger blacklisting
- Below 2% bounce rate = domain stays healthy, deliverability stays high
Free verification tools:
- NeverBounce — 1,000 free on signup, $8/1K after
- ZeroBounce — 100 free/month, most accurate syntax checking
- Reoon — Fast, cheap, decent accuracy
- Mail-tester.com — Test your sending domain, not individual addresses
Building a System vs. One-Off Lookups
If you're finding emails one at a time, you'll never have enough for serious outbound. The goal is to batch:
- Scrape a list of prospects (LinkedIn, Google Maps, Apollo)
- Export as CSV: name, company, domain
- Run the entire list through Hunter's bulk domain search API
- Construct emails from patterns
- Bulk verify with NeverBounce
- Remove invalid emails, dedupe, upload to your sending tool
This workflow produces 100-500 verified contacts per hour at essentially zero cost. I use it to build the lead lists behind every campaign I run.
📖 The Full Lead Building System
The playbook covers the entire process — from scraping to enrichment to email finding to verification to sending. Includes the actual workflows I use to build 500+ lead lists from scratch.
Get the Playbook — $29What to Do When Nothing Works
Occasionally you'll hit a contact where all 7 methods fail. Options:
- Try LinkedIn InMail — Lower response rate, but sometimes the only door
- Contact the company's general inbox — Ask to be forwarded to the right person
- Twitter/X DM — Many executives are reachable this way, especially in tech
- Find a mutual connection — A warm intro beats any cold email
- Wait and watch — Set a Google Alert for their name. When they publish something, comment and introduce yourself in the thread
The hard truth: some contacts aren't reachable via email. That's okay. Move on to the next prospect rather than spending 30 minutes chasing one lead.
🛠️ Automate Email Finding at Scale
The OpenClaw Cold Email Skill integrates with Hunter, Apollo, and NeverBounce to build and verify lead lists automatically — no manual lookups required.
Get the Cold Email Skill — $9