TL;DR: Start by confirming the company's email format using Hunter's domain search or Google operators. For individual targets, apply the format and verify before sending. For list-building at scale, use Apollo or Clay to pull and enrich contacts, then verify the full list before importing to a sequencer.
How to Find Company Email Addresses: 6 Methods That Work in 2026
Last updated: May 2026
Finding a company email address sounds easy until you've spent two hours on a single contact. The issue isn't effort. it's method. Most failed lookups come from guessing formats and sending to multiple unverified addresses, which racks up bounces and damages your sender reputation. This guide walks through six methods in order of complexity: from free, manual techniques to paid databases and automated workflows. Use the simpler methods for individual high-value targets. Move to paid tools once you're building lists of 50 or more.
Why Guessing Email Addresses Backfires
Most people cycle through common patterns: firstname.lastname@company.com, flastname@company.com, firstname@company.com. Sending to several unverified variations at once is the fastest way to accumulate hard bounces.
Email servers track your sending domain's bounce rate. Push it too high and inbox providers start routing your messages to spam. not just for that contact, but for every email you send from that domain. Rebuilding that reputation takes weeks.
The fix is simple: confirm the format using one known address, then verify the specific email before sending. The methods below do exactly that.
Step 1: Identify the Company's Email Format
Most companies use one consistent email format across all employees. Once you confirm the pattern for a single person at the company, you can apply it to anyone else there. That's far more reliable than guessing for each contact individually.
The five most common B2B email formats:
firstname.lastname@company.com(e.g., john.smith@acmecorp.com)flastname@company.com(e.g., jsmith@acmecorp.com)firstname@company.com(e.g., john@acmecorp.com)firstinitial.lastname@company.com(e.g., j.smith@acmecorp.com)firstname_lastname@company.com(common in older or larger organizations)
Three ways to confirm the format without guessing:
Hunter.io domain search. Enter the company's domain at hunter.io and Hunter returns every email address it has found publicly for that domain, along with the detected format. This works on the free tier. Even if Hunter doesn't have the specific contact you need, the format detection alone is what you're after.
Google site: operator. Search for "@company.com" site:company.com in Google. This surfaces any page on the company's domain that contains an email address in plain text. author bios, press releases, contact pages, and job postings. One confirmed email tells you the format for the whole company.
Press releases and author bios. Companies consistently use a PR contact email in press releases. Search for "company name" press release on Google News or PR Newswire. The PR contact email at the bottom confirms the format, even if that person isn't your target.
One more source worth checking: GitHub. Engineers often push commits using their work email. Search GitHub for "@company.com" in the search bar or look at commit history for repositories belonging to the company's organization. This surfaces work emails that don't appear anywhere else publicly.
The rule that prevents bounces: confirm the format from one known address, then verify the constructed email before sending. Finding the pattern tells you what the address likely is. Verification (Step 5) confirms the address actually exists. Never skip that step, even when you're confident in the format.
Step 2: Manual Research Techniques That Still Work
Email finder tools cover most situations, but there are cases where manual research outperforms them. Contacts at very early-stage companies, executives who maintain low online profiles, and people at companies too small to show up in B2B databases often aren't indexed anywhere. Manual research closes that gap.
Google advanced search operators
Google indexes a significant share of the public web, including email addresses in plain text. These queries find them:
"@company.com". finds any publicly indexed page containing an email at that domain"firstname lastname" email site:company.com. searches the company's own website"firstname lastname" contact "@company.com". broad search across the whole web"john.smith@company.com". put a guessed pattern in quotes to find exact matches anywhere they appear publicly
The last query is the most reliable confirmation method. If someone's email exists publicly, an exact-match Google search will usually surface it.
LinkedIn is useful in two distinct ways. First, check the person's Contact Info section directly. A meaningful share of LinkedIn members list their work email there, particularly in sales, BD, or founder roles. The Contact Info tab is behind a small icon next to their profile photo. easy to miss.
Second, find colleagues at the same company who do have visible emails. One confirmed email from a colleague gives you the format to apply to your target. Look for team members in roles that typically include contact info publicly: SDRs, account managers, customer success.
If the target's profile is private, you can often still see their name from search results. That's enough to apply the format you've already confirmed.
Press releases and coverage
Every press release includes a media contact at the bottom, usually with a direct email. Even if that contact isn't who you're trying to reach, their email confirms the company's format. Search "company name" press release -site:company.com to find third-party coverage that includes the full email address.
Company team and About pages
Many company websites list team members with titles and photos but no emails. Still useful: these pages confirm the exact spelling of names, which matters when applying an email format. Some smaller companies include mailto links in the page source. view source (Ctrl+U) and search for mailto: to find any that aren't visible in the rendered page.
When manual research is worth the time
Manual research is high-confidence but time-intensive. Spend 10-15 minutes per contact only when the target is high-priority and not appearing in any tool. For outreach to more than 20-30 contacts, the manual approach becomes the bottleneck. Move to a tool at that point.
Run outbound on autopilot.
Lead lists, enrichment, ICP qualification, personalized openers, sequencer push. Miniloop runs the loop, you take the meetings.
Step 3: Use a Free Email Finder Tool
Several free email finder tools work well for individual lookups and small-scale prospecting. Each has a monthly credit limit, so they're best for getting started or for targeted searches where you need a handful of emails quickly.
Hunter.io
Hunter is the most widely used free email finder. The free tier gives you a fixed number of searches per month and two key features: the domain search (which shows all emails Hunter has indexed for a company domain plus the detected format) and the individual email finder (which takes a name and domain and returns the email with a confidence score).
For individual lookups, go to Hunter's Email Finder tab, enter the person's first name, last name, and company domain. Hunter returns the email with a confidence score. Treat anything above 90% as reliable. For scores below 70%, run a separate verification step before sending.
Hunter also offers an email verifier as a standalone feature. paste an address and get its deliverability status without using a search credit.
GetProspect
GetProspect's free plan includes a small monthly credit for email lookups. It's strongest for LinkedIn-based searches. The Chrome extension integrates with LinkedIn profiles, letting you pull contact data directly from a person's page without leaving LinkedIn. If you spend time prospecting on LinkedIn, the extension saves meaningful time compared to switching between tabs.
Skrapp.io
Skrapp focuses on company-level email finding. Enter a domain and it returns the email addresses it has indexed for that company, along with the format pattern. Like Hunter, it also has a LinkedIn extension. The free tier has tighter limits than Hunter but works well for format detection.
What free tools can't do
Free tools have two hard limits. First, their databases are smaller than paid options. a contact who hasn't appeared publicly in an indexed source simply won't be there. Second, monthly credit limits make them impractical for any list-building at scale. If you need more than 50 contacts in a month, you'll hit the ceiling quickly.
Use free tools for: confirming an email format before applying it manually, one-off lookups for high-priority targets, and evaluating a tool before committing to a paid plan. For volume, move to Step 4.
Step 4: Scale With a Paid Email Database
Free tools cover individual lookups. When you're building a list of 200 or 2,000 verified contacts, you need a paid database. The right choice depends on how you're prospecting.
Apollo.io
Apollo is one of the most comprehensive B2B contact databases available. It indexes millions of professional email addresses and lets you filter by job title, seniority level, company size, industry, location, funding stage, and dozens of other criteria. You build a list of target contacts directly in Apollo, get their email addresses, and export to a CSV or push to a CRM.
Apollo's strength is the combination of prospecting filters and contact data in one place. You're not just finding emails for a pre-existing list. you're building the list and finding the emails in a single workflow. For a detailed breakdown of what each plan covers, see Apollo.io Pricing 2026.
The main pitfall: vague filters produce large, low-quality lists that waste credits and produce poor outreach results. Spend time narrowing your ICP before running bulk exports.
Clay
Clay is a data enrichment tool that sits between prospecting and outreach. You build a table of leads from multiple sources. LinkedIn, Apollo, company websites, job postings, news mentions. and Clay enriches each row with verified contact data including email addresses.
Where Clay stands out is workflow flexibility. You can pull a list of companies matching a specific intent signal (recently hired a VP of Sales, posted jobs mentioning a specific tool), enrich each with the relevant decision-maker's contact info, and route the output directly to your sequencer. Our Clay email finder guide covers the specific enrichment setup.
Clay makes more sense than Apollo when you're working from a signal-based starting point rather than broad ICP filters. The per-row enrichment credit model also means you only pay for what you actually enrich.
Hunter.io paid
Hunter's paid plans are the right choice for teams that already have a list of names and company domains and need to find verified emails for each. Unlike Apollo, Hunter doesn't include a full prospecting database. it's a dedicated email finder and verifier. The paid plans increase monthly search limits and add bulk finder functionality (upload a CSV of names and domains, get emails back).
How to choose
Start with Apollo if you need to build a prospecting list from scratch using ICP filters. Use Clay if you're pulling contacts based on intent signals and need enrichment from multiple data sources. Use Hunter paid if you already have a list and just need email addresses found and verified at scale. Most teams end up using a combination as their outbound process matures.
For a direct comparison of the two most commonly paired tools, see Clay vs Apollo.
Step 5: Verify Every Email Before You Send
Email verification checks whether an address is deliverable before you send to it. This step is non-negotiable at any outreach volume.
Why it matters
Email servers track your domain's bounce rate. Send to too many invalid addresses and inbox providers. Gmail, Outlook, company mail servers. start routing your messages to spam. Not just for those contacts. For everyone you email from that domain. Rebuilding a damaged sender reputation takes weeks of reduced sending volume and careful monitoring.
Most email finder tools return a confidence score or deliverability status alongside the address. The common labels:
- Valid: The server confirmed this address exists and can receive mail. Safe to send.
- Catch-all / Accept-all: The company's mail server accepts email sent to any address at the domain, regardless of whether the specific mailbox exists. The tool can't confirm if your address is real. Emails to catch-all domains may deliver or may bounce.
- Invalid: The address does not exist. Do not send. This is a guaranteed hard bounce.
- Unknown: The tool couldn't determine status. Treat like catch-all.
Verification tools
If your email finder doesn't include built-in verification, run your list through a standalone verifier before sending. NeverBounce, ZeroBounce, and Clearout are the most commonly used options. Each accepts bulk CSV uploads and returns a deliverability status for every address.
Practical sending rules
- Send only to Valid addresses in your first round of outreach.
- Keep catch-all addresses in a separate segment. If you send to them, monitor bounce rates carefully and stop if they spike.
- Strip Invalid and Unknown addresses before importing to any sequencer.
- Aim to keep your overall hard bounce rate below 2%. Most sequencer tools (Instantly, Smartlead, Outreach) warn or auto-pause sends if the rate climbs higher.
Verification is cheapest when you run it as a batch step before every list import, not as a reactive fix after problems appear. One list verification run is far easier than repairing a damaged domain.
Step 6: Build a Repeatable Outbound Workflow
The six steps in this guide work best as a sequence, not as isolated lookups. Here's how to wire them into a workflow you can run consistently.
For individual high-priority contacts (up to 20-30):
- Confirm the company's email format using Hunter's domain search or a Google site: operator search.
- Find the exact name spelling via LinkedIn or the company's team page.
- Apply the confirmed format to construct the address.
- Verify the address using Hunter's verifier or a standalone tool.
- Write a specific, relevant opener. Reference something you know about the person, their company, or their recent activity.
This approach works well for enterprise outreach or for small lists where each contact is high-value enough to justify manual research.
For list-building at scale (50+ contacts):
- Use Apollo or Clay to filter for contacts matching your ICP (title, company size, industry, funding stage).
- Export the list with email addresses (Apollo provides these directly; Clay enriches from multiple sources).
- Run the full list through a verifier to remove Invalid addresses and flag catch-alls.
- Segment by deliverability status before sending.
- Push Valid contacts to your sequencer. Instantly, Smartlead, Outreach, or Salesloft. with sequences ready to run.
This workflow handles hundreds of contacts efficiently. The bottleneck shifts from finding emails to writing outreach that actually gets replies.
Common mistakes at this stage
Skipping verification before import. Even one batch of bad data can spike your bounce rate enough to flag your domain. Verify every list, every time.
Sending the same message to everyone. Segmenting by company stage, title, or a specific signal produces meaningfully better reply rates. A message that references something relevant gets opened; a generic one doesn't.
Not warming a new sending domain. If you're starting outbound with a new domain, warm it gradually over 2-4 weeks before running sequences at full volume. See the cold email deliverability guide for B2B startups for the specific setup steps.
Once you have a verified list and a sequencer loaded, the workflow runs. The next question is whether building and maintaining this process is the best use of your time.
How Miniloop Handles the Email Finding Busywork
The tools and methods above handle finding and verifying email addresses. But running outbound involves more. The busywork: pulling lead lists from Apollo on a cadence, enriching contacts through Clay, segmenting by ICP fit, writing personalized openers for each segment, pushing verified contacts to your sequencer, and monitoring deliverability and reply rates week over week.
Miniloop handles that busywork. We build and run outbound workflows for your team:
- Pull and enrich lead lists from Apollo and Clay based on your ICP criteria, updated on whatever cadence you need. weekly refreshes, monthly list builds, or triggered by specific events.
- Apply signal-based filters to surface contacts at companies showing buying intent: recent funding rounds, new VP of Sales hires, competitors' job postings, or executive activity on LinkedIn.
- Write personalized openers for each contact based on their role, company context, and any relevant trigger event. so outreach goes out with a real reason to reach out, not a generic pitch.
- Push verified contacts to your sequencer. Instantly, Smartlead, Outreach, or Salesloft. with sequences structured and ready to run.
- Monitor deliverability and reply rates and flag anything that needs attention before problems compound.
Whether you're running outbound yourself, managing a small SDR team, or still figuring out whether to hire, Miniloop handles the execution work. You focus on the conversations once replies come in.
Try Miniloop or browse templates.
Related Reading
- Clay Email Finder: Features, Pricing, and How to Use It in 2026
- Best AI SDR Tools in 2026: 8 Platforms Ranked and Reviewed
- Top 8 Salesloft Competitors in 2026: Find the Right Sales Engagement Fit
- SEO Agency vs In-House: How to Choose the Right Model in 2026
Related Resources
- Platform - How Miniloop's GTM agent platform works
Frequently Asked Questions
Is it legal to find and use business email addresses for cold outreach?
Finding and using publicly available business email addresses for professional B2B outreach is legal in most jurisdictions. CAN-SPAM (US) and GDPR (EU) regulate how you contact people. requiring a clear sender identity, a working unsubscribe mechanism, and an honest subject line. rather than prohibiting cold outreach to business contacts. Under GDPR, legitimate interest is a recognized legal basis for B2B cold email when the content is relevant to the recipient's professional role and company. Always honor unsubscribe requests immediately and keep your list current to avoid contacting people who've opted out.
What does 'catch-all' mean in email verification?
A catch-all domain (also called accept-all) is configured to accept email sent to any address at the domain, regardless of whether a specific mailbox actually exists. Email verification tools can confirm the domain accepts mail, but they can't confirm whether your specific address is real. Emails sent to catch-all addresses may deliver normally or may bounce. you can't know until you send. Treat catch-all addresses as usable but uncertain. Keep them in a separate segment, monitor bounce rates closely on any sends, and stop sending to that segment if bounces climb above 3-4%.
How do I find email addresses for contacts who aren't on LinkedIn?
LinkedIn gaps are common for early-stage founders, deeply technical executives, and professionals outside North America or Western Europe. For contacts not on LinkedIn: search GitHub for commits associated with the company domain (engineers often push with work emails); look for press releases or conference speaker bios that include the person's contact info; check the company website's page source for mailto: links that don't render visibly; use Apollo's domain search, which pulls from a broader set of sources than LinkedIn alone. If none of those work, confirm the company's email format from someone who is public, then construct and verify the target address before sending.
What is a safe bounce rate for cold email campaigns?
Most email service providers and sequencers treat a hard bounce rate above 2% as a warning threshold. Above 5%, your sender reputation starts to degrade and inbox providers begin routing your messages to spam. Tools like Instantly and Smartlead track bounce rates per campaign and may auto-pause sends if the rate spikes. The simplest way to stay well below the threshold: verify every list before importing to your sequencer. Removing Invalid addresses and being conservative with catch-all sends costs almost nothing compared to rebuilding a flagged domain.
Should I use a separate domain for cold outreach?
Most outbound teams create a separate sending domain for cold sequences (e.g., tryyourcompany.com or hello.yourcompany.com), keeping the primary domain clean for transactional email and inbound communication. If your cold outreach triggers a spam complaint or a bounce rate spike, it affects only the sending domain rather than the main domain your product or customer emails go through. The separate domain needs to be warmed before high-volume sending. See the [cold email deliverability guide for B2B startups](/blog/cold-email-deliverability-guide-b2b-startups) for the warmup steps and infrastructure setup.
