You can find almost anyone's work email with six methods, from most to least reliable: work out the company's address pattern from a known address, search the name in quotes, check LinkedIn and the company site, use an email finder tool, or make a pattern guess. Each gives you a candidate, not a confirmed address, so the step that makes any of them work is verifying the result before you send, because across finder output 10 to 25% is invalid.
Find one real address at the company (a press page, a signature, a careers email), see its format (first.last@, f.last@, first@), and apply it to the person you want. The single most reliable method for a known company.
Put "Full Name" and the company or domain into a search engine. Real work addresses surface in signatures, directories, slide decks and press releases. Add the word "email" or the domain to narrow it.
The contact or about page often lists a direct or role address. On LinkedIn, the profile or its contact-info panel sometimes shows it; a Sales Navigator export plus enrichment does it at scale. See the LinkedIn email finder guide.
Hunter, Apollo, FindyMail and others take a name and company and return a probable address. Fast, but they return a guess with a confidence score, not a confirmed mailbox. Compared in the email finder guide.
If all else fails, generate the handful of likely formats (first.last, flast, first) at the domain and test each. Most companies use one of about six patterns.
The overlooked method. A short message on LinkedIn or through a mutual contact often gets you the address directly, and it starts the relationship you wanted anyway.
This is the part people skip. The pattern might be wrong, the person might have left, the finder tool is inferring from old data. A found address is a candidate until something checks it against the live mailbox. Across the leading finder tools, 10 to 25% of what they return is invalid at the moment you export it, and a guessed pattern on a catch-all domain looks right but bounces.
So whichever method you use, the last step is the same: verify the candidate before you send to it. One bounce on a cold first email tells the recipient's server you are sending blind, which is exactly the wrong first impression.
Methods 1 to 3 by hand, then verify the single address with a free check. No tool subscription needed; the free tier covers 100 checks a month.
A finder tool or a LinkedIn export to get the candidates, then bulk verification to strip the 10 to 25% that would bounce before you import them.
The B2B-focused version, with the sources ranked for work addresses, is in how to find business email addresses.
Finding a work address to contact someone about their job can rest on legitimate interest in the UK and EU; personal addresses and consumers need consent. Keep only what you need and honour opt-outs.
Work out the company's address pattern from one known address, or search the person's name in quotes with the company domain; real work addresses show up in signatures, directories and press pages. Then confirm your candidate with a free verifier, which checks the live mailbox without sending. BounceZero's free tier covers 100 such checks a month, so finding and confirming one address costs nothing.
Working out the company's address pattern and applying it to the person. Find one real address at the company, see its format, and generate the one you want. It beats finder tools for a known company because you are reasoning from a confirmed example rather than an inferred guess, though you should still verify the result.
Most work addresses, yes, through the company pattern, a search, LinkedIn or a finder tool. Personal addresses are harder and often should not be pursued for outreach, since contacting consumers needs consent. Whatever you find is a candidate until you verify it against the live mailbox, because patterns and finder tools both produce guesses.
The leading tools return a valid address 65 to 85% of the time, which means 15 to 35% is wrong, catch-all or unconfirmable at the moment you use it. They return a confidence score, not a confirmed mailbox. Always verify a found address before sending, especially for a cold first email where one bounce signals you are sending blind.
Finding a work address and emailing that person about something relevant to their role can rest on legitimate interest in the UK and EU, if you document it, say where you got the address, and honour opt-outs. Personal addresses and consumers need consent. This is general information, not legal advice; your own privacy notice applies.
Found an address? Check it is real in under a second, free, before it bounces on a cold first email. 100 checks a month at no cost.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated sending infrastructure, and the high-availability database behind every verification. Previously built high-volume email delivery systems. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Where leads come from, how finders work, and what a verified lead is - with 2026 corpus data
Sellers compared, with sample-check rules
Where verification sits in the funnel
Seven sources ranked by data quality, build vs buy, the verify-enrich-score-segment workflow
MQL, SQL, PQL and verified leads; sources, qualification, reachability in the score
How finders work, Hunter vs Apollo vs Snov vs Clay, finder vs verifier
Extensions, Sales Navigator exports, accuracy, the legal line
Continue through related topics