Email lookup means either finding the address for a known person (forward lookup) or finding who is behind a known address (reverse lookup). Both can be done free for small volumes: finder free tiers give 25 to 50 finds a month, the company pattern can be inferred from two public addresses, and the result can be checked with a free verifier. Accuracy is the catch. Guessed addresses are wrong often enough that, in the BounceZero corpus, April to October 2026, 14.5% of non-freemail (business and ISP) addresses on contact lists were invalid. This guide ranks six free methods, gives the accuracy to expect, and sets out the legal limits.
Ranked by accuracy of the address you end up with, assuming you verify it afterwards. Monthly limits are the vendors' published free tiers at the time of writing and change often.
| Method | Type | Free limit | Accuracy before verifying | Time per lookup |
|---|---|---|---|---|
| Pattern inference plus verification | Forward | 100 checks a month on BounceZero | 75 to 90% at fixed-pattern companies | 3 to 5 min |
| Finder free tier (Hunter, Snov, Apollo) | Forward | 25 to 50 finds a month each | 65 to 85% | 1 min |
| Domain search on a finder | Forward, company-level | Included in free tiers | Shows the pattern and a few names | 1 min |
| Public sources (site, press, GitHub, filings) | Forward | Unlimited | High when found, low find rate | 5 to 15 min |
| Email header and signature mining | Forward | Unlimited | High, limited to people who emailed you | 2 min |
| Reverse lookup (search the address) | Reverse | Unlimited | Depends on the person's public footprint | 2 to 10 min |
Accuracy ranges for finders are the on-site figures from the finder comparison; pattern-inference accuracy depends on whether the company uses one format. Verify every result before using it.
The most accurate free route for a known person at a known company. It needs the company domain and two or three existing addresses.
Press contacts, the careers page, a conference speaker list, a GitHub commit, a PDF whitepaper footer. A domain search on a finder free tier also shows the format without charging a find.
first.last, firstlast, f.last, first, last.first, first_last. Companies over a few hundred staff almost always use one; small firms and agencies often mix two.
Apply the pattern to the person's name. Watch for nicknames (Bill versus William), hyphens, accents and double surnames; generate the two most likely variants if unsure.
Paste the candidate into the free verifier. Valid means the mailbox exists. Catch-all means the domain accepts anything and the guess is unconfirmed. Invalid means try the next variant. Unknown means the server would not say; try again later or use another channel.
Next time you need someone at that company, skip to step three.
Each has a situation where it is the fastest option and a failure mode worth knowing.
Hunter, Snov, Apollo, RocketReach and others publish free allowances of roughly 25 to 50 finds a month. Stack two or three and you have a hundred free finds. The returned address carries a confidence score that reflects indexing-time checks, not today; the on-site Apollo accuracy study found 5.8% of addresses were invalid at export and a further 18.4% were catch-all, an effective bounce exposure of 15 to 20% once catch-all bounce rates are counted. Verify anyway.
Type the company domain into a finder and it shows the detected pattern plus a handful of names it has seen. Free tiers usually show the pattern and mask the full list. Enough to run method one without hunting for public addresses.
The company site, press releases, conference programmes, GitHub, regulatory filings, academic papers and PDF metadata. Slow, but the address is real rather than inferred. Best for executives, researchers, journalists and founders who publish.
Anyone who has emailed you or your colleagues is in the mail archive with a confirmed address, and their signature often lists colleagues. Search the shared inbox before searching the web. Limited to people already in contact, which is also what makes it reliable.
Search the address in quotes in a web search engine, then on LinkedIn, GitHub and Gravatar. Works when the person has used the address publicly. Fails for most corporate addresses. Paid reverse-lookup services exist, and many of them operate at the edge of data-protection law; see the legal section.
Guessing without verifying, mass-generating variants and sending to all of them, and buying "lookup" credits from sites that resell scraped lists. Each produces bounces, and a bounce rate above 2% throttles the sending domain.
A lookup is half the job. The other half is confirming the address exists today. The free tier on BounceZero gives 100 checks a month with no card, through the free email verifier, and returns one of five results: valid (mailbox confirmed), invalid (mailbox does not exist), catch-all (domain accepts any address, so the guess is unconfirmed), unknown (the server would not answer), and role (a shared mailbox such as info@ or sales@).
The honest result matters more than a confident one. Corporate gateways and some ISPs refuse verification probes, so a share of non-freemail (business and ISP) addresses can only ever come back unknown: 27% across non-freemail (business and ISP) lists in the corpus, 41% on German lists because of one provider. A tool that never returns unknown is guessing on that share. An address that cannot be confirmed is reported as unknown and never sold as valid.
Corpus cuts that matter for lookup. Provider and country decide how confirmable an address is before you even try.
| Segment | Addresses | Invalid | Catch-all | Unknown | Confirmed valid |
|---|---|---|---|---|---|
| Non-freemail (business and ISP) domains | 6,514,884 | 14.5% | 2.3% | 27.0% | 32.6% |
| Freemail | 1,415,154 | 17.6% | 1.1% | 2.1% | 74.0% |
| gmail.com | 801,225 | 3.5% | 0.0% | 0.0% | 96.0% |
| .org domains | 56,401 | 24.6% | 12.4% | 25.0% | 36.2% |
| .de domains | 2,095,440 | 13.9% | 0.0% | 41.2% | 16.5% |
| .uk domains | 21,194 | 17.0% | 3.7% | 10.6% | 65.0% |
BounceZero corpus, April to October 2026. Full tables on the lead list quality benchmarks page.
Finding a work address and writing to that person about something relevant to their role can rest on legitimate interest under UK GDPR and the EU regulation, if you record the reasoning, say where the address came from, honour opt-outs and keep nothing you do not need. Reverse-looking-up a personal address to identify a private individual, building a profile from several sources, or emailing consumers without consent does not pass that test, and PECR in the UK adds a consent requirement for marketing to individuals. CAN-SPAM in the US is lighter but still requires a working opt-out and a physical address in the message.
The practical rule: look up work addresses for a work reason, verify before you send, say how you found them, and delete what bounces. None of this is legal advice.
Free lookup is a two-step: find a candidate, confirm it exists. Skipping the second step turns a free lookup into a paid bounce.
How finders work and which to use at volume
Eight methods ranked by accuracy
Why both exist and what each returns
100 checks a month, no card
Why a guessed address can look valid
Company-level lookup and the domain pattern
Find two existing addresses on the company domain from its website, press releases or a finder's domain search, read the format, apply it to the person's name, and check the candidate with a free verifier. BounceZero gives 100 free checks a month. Finder free tiers add 25 to 50 finds a month each if you would rather have the tool guess for you; verify those too.
No finder is unlimited and free, but Hunter, Snov, Apollo and RocketReach each publish a free monthly allowance of roughly 25 to 50 finds, and stacking them gives about a hundred. For a known company, pattern inference plus a free verifier needs no finder at all and is often more accurate, because the result is confirmed rather than scored.
Finder free tiers return the same data as their paid tiers, so accuracy is 65 to 85% depending on the tool and the company. Pattern inference is 75 to 90% at companies with one fixed format and much lower at small firms that mix formats. The verifier is what makes either method reliable: it tells you whether the candidate exists today rather than when it was indexed.
Partly. Searching the address in quotes, then on LinkedIn, GitHub and Gravatar, identifies people who have used it publicly. It rarely works for corporate addresses and should not be used to identify private individuals from a personal address, which raises data-protection issues in the UK and EU. Paid reverse-lookup services exist and vary widely in how lawfully they source data.
Because the finder checked when it indexed the record, which may be months ago, and business addresses decay fast, with only 19.2% of addresses still valid 90 days after verification in the BounceZero decay study. Catch-all domains also accept any address at the finder's check and then bounce or silently drop later. A verifier checks at the moment you ask and labels catch-all separately, which is why the two tools are used together.
Paste it in and get valid, invalid, catch-all or unknown in seconds. 100 free checks a month, no card, unknowns never sold as valid.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Where leads come from, how finders work, and what a verified lead is - with 2026 corpus data
Verify an email list in bulk
Email finder for companies
Clay data enrichment explained
Apollo lead generation guide 2026
8 channels that build pipeline, by budget
Tools by stage with data accuracy notes
Continue through related topics