How to Find a CEO's Email Address, and When It Can't Be Verified

To find a CEO's email, the method depends on company size. At small companies the owner often reads the address on the website, so use it. At large ones, apply the company's pattern to the CEO's name, but expect the result to be unverifiable: in our test of 60 large US companies, no mail server confirmed or denied a mailbox.

Most guides to this topic list the same search tricks and stop. The search tricks are fine. What they skip is the part that decides whether your email lands: whether the address you end up with can actually be checked, and who reads it when it arrives.

Small and large companies are different problems

	Small business (owner-run)	Large company
Who reads the CEO's mail	Usually the owner	Often an assistant, or a filter first
Where the address comes from	The website	A pattern guess
Can you verify it	Sometimes; many small domains are catch-all	Rarely; gateways block or accept everything
Is the CEO the buyer	Usually	Rarely, for most purchases
Best route	Published address or owner's direct address	The budget owner, or the CEO via a pattern guess sent with care

Small companies: start with the website

At an owner-run business, the owner is usually the CEO, the buyer and the person reading the inbox. The website is the best source.

1. Check the about and team pages. Owners often name themselves, sometimes with a direct address.
2. Check the contact page and footer. A published info@ or office@ at a five-person firm is very often read by the owner.
3. Check the domain's other public footprint: press mentions, local news, award listings, conference or trade association pages.
4. If you have the owner's name but no address, find any one published personal address at the domain to get the pattern, apply it, and verify. See company email patterns.

Verification works more often at small companies than large ones, but less often than you might hope. In a separate check of 337 US trades businesses on the same day, 52 of the 145 mail servers that gave a definite answer rejected a made-up address, so a real guess could be confirmed or ruled out there. The other 93 accepted the made-up address: they are catch-all, and a guess at the owner's name can only come back as risky. The method and data are in building a local business email list.

Large companies: the address is a guess

At a large company, the CEO's address almost always follows the company's standard pattern, but you cannot confirm it from outside. We measured why.

What we measured

On 1 October 2026 we took a convenience sample of 60 large US companies, chosen from the best-known names on the Fortune 500 list, and for each one:

1. Looked up the MX records for the company's main website domain.
2. Opened an SMTP connection to the primary mail server.
3. Asked it to accept mail for a random, certainly non-existent address, such as zz plus 14 random characters at the domain. No message was sent.

A server that rejects the random address can, in principle, tell you whether a real one exists. A server that accepts it cannot, because it would accept anything. The full results are in our research file.

What we found

Result	Companies	What it means
Server refused our test connection on reputation grounds	49	No answer about any mailbox
Server accepted the made-up address	6	Accept-all: no address can be confirmed
No MX record on the website domain	4	Company mails from a different domain
Connection refused	1	No answer
Server rejected the made-up address	0	The only case where verification works

Three findings worth taking from that.

Almost all of them sit behind security gateways. By MX record, 39 of the 60 routed mail through an enterprise filtering service such as Proofpoint, Mimecast or Cisco, and 9 used Microsoft 365 directly. None used Google Workspace.

Gateways judge you before they hear the address. Our test ran from a shared network address that was listed on Spamhaus blocklists at the time, and 49 servers refused it on reputation grounds, most of them before we could even name a recipient, quoting reputation services in the rejection, for example:

554 Blocked - see https://ipcheck.proofpoint.com/?ip=...
550 5.7.1 Service unavailable, Client host [...] blocked using Spamhaus

A professional verifier on clean, well-configured infrastructure will get past many of those. That is the reason verification is a service: most networks cannot do it at all.

The servers that did answer accepted everything. All six that gave an answer about the recipient itself replied 250 to an address that does not exist:

RCPT TO:<zz2ft4yfxqyp4w37@intel.com>
250 recipient <zz2ft4yfxqyp4w37@intel.com> ok

That is accept-all behaviour. The gateway takes the message and decides later, internally, whether anyone receives it. From outside, ceo.name@ and nonsense@ look identical. A clean IP does not fix that.

So for the large-company half of this question, the honest output of any verifier is risky or unknown. A tool that reports a Fortune 500 CEO's guessed address as "valid" is reporting the gateway's policy, not the mailbox.

The email domain is not always the website domain

Four of the 60 had no MX record on their main website domain, because they receive mail on a different one. We checked the obvious alternatives: jpmchase.com, p66.com, lmco.com and cat.com all publish MX records. A pattern applied to the website domain would have bounced at every one of those four.

Before guessing, find one real published address at the company, in a press release or an investor relations page, and use its domain.

Finding the pattern for a large company

Use any published address from the company, then apply it to the CEO's name. Good public sources:

• Press releases: media contact addresses show the format, for example firstname.lastname@.
• Investor relations pages: IR contacts are often named.
• Regulatory and public filings: contact names and addresses sometimes appear.
• Conference and industry pages: speakers from the company.

Patterns at large companies are fairly predictable. One vendor's study of its own B2B database, Sendburg's analysis of 336,782 work emails from July 2026, found first.last@ in 74.2% of addresses at companies with more than 10,000 staff, against 38.0% at companies of 1 to 10. Treat that as one data provider's view of its own data, not a census, but it matches what you see in press releases.

Note that some executives use a different or private address precisely because the pattern one is so easy to guess.

Who actually reads it

At large companies, assume an assistant or a filter sees a CEO cold email first. Write for that reader: a short message whose relevance is obvious in the first line, with nothing that would make forwarding it awkward.

Often the better target is not the CEO at all. For most purchases, the decision sits with the person who owns the budget, and a CEO who is interested will forward the email down to that person anyway. Emailing them directly skips a step.

At owner-run businesses the opposite holds: the owner is the buyer, so go straight to them.

How to send to an unverifiable address

If you must send to an address you could not confirm, keep it out of your main sends.

• Send it from a warmed inbox in a small, separate batch with other unconfirmed addresses.
• Send once. Do not run a five-step sequence at an address you are not sure exists.
• Watch for bounces and remove the address immediately if one arrives.
• Never generate and send every permutation of a name to see which one sticks. Mail servers treat that pattern as abuse, and US law treats addresses produced by permuting names as a harvesting problem.

A single bounce is cheap. A batch of guessed executive addresses bouncing together is the kind of thing that moves your bounce rate enough to hurt every later send.

The takeaway

At small companies, the owner is usually reachable through the address on the website, and a guess at their own address can be verified wherever the domain is not catch-all. At large companies, the pattern is easy to find but the mailbox cannot be confirmed, because enterprise gateways either refuse to answer or accept everything. Send those as single, separate, unconfirmed messages, and consider whether the CEO is really the person you need to reach. You can check how any address comes back with our free email verifier.