How to Find Someone's Business Email Address: 7 Methods That Work

The most reliable way to find someone's business email is an address they published themselves: a signature, their company website, a press release. After that come pattern guesses and finder tools, which need verifying before you send. Here are seven methods ranked by trust, plus what we found on 302 small-business websites.

The order matters because each step down the list replaces evidence with inference. An address someone put on their own website is almost certainly real. An address a tool assembled from a naming pattern might be, and only a mail server can tell you.

The seven methods, ranked

#	Method	Trust	Cost	Needs verifying
1	Ask, or use one they already sent you	Highest	Free	No
2	Company website: team, about, contact pages	High	Free	Lightly: sites carry typos
3	Public documents: press releases, speaker pages, filings	High	Free	If old
4	LinkedIn Contact info, where shared	High	Free	Often a personal address
5	Pattern from a colleague's published address	Medium	Free	Yes
6	Email finder tool	Medium	Credits	Check how it labels catch-all
7	Switchboard, contact form or reception	Indirect	Free	You get an address from a person

1. Ask, or look in what they already sent you

If you have ever exchanged email with the person or their colleagues, the address is already in your inbox. Search your mail and your CRM before anything else. A signature in a thread from a colleague also gives you the company's format, which feeds method 5.

Asking directly is underrated. A one-line LinkedIn message or a call to reception asking for "the best email for Jane in purchasing" gets you a confirmed address and a warmer start.

2. The company's own website

Owners and staff at smaller companies frequently publish their addresses on team, about and contact pages. This is the best free source for small and mid-sized businesses.

What we found when we checked. On 1 October 2026 we took 337 roofing, plumbing, HVAC and electrical businesses with websites listed in OpenStreetMap across 11 US metro areas, and looked for addresses on each homepage and up to two contact pages. Of the 302 sites that loaded:

Finding	Sites
Published at least one email address	156 (52%)
Published an address on their own domain	111
Of those, published a role address (info@, office@, service@...)	96
Of those, published at least one named person's address	19
Published a Gmail, Yahoo or other free webmail address	23
Published an address on a domain that cannot receive mail as written	3

Two lessons. First, about half of small-business sites publish no address at all on those pages, so the website is a good method, not a complete one. Second, published does not mean correct: two sites listed addresses on misspelt versions of their own domain (a missing letter in each), which have no DNS records at all, and a third listed an address on a parked domain. Those would bounce. Method and raw data are in our local business list guide.

Two practical tips:

• Look beyond the homepage. Contact, about, team, careers and footer areas all carry addresses. Our check looked only at the homepage and up to two contact pages.
• Check the domain of the address. A published address on a different domain from the website, or on a free webmail service, is common at small firms and tells you where mail actually goes.

3. Public documents

Anything a company publishes for outsiders to contact it is fair game: press releases, investor relations pages, conference speaker bios, published papers, trade association listings.

A search engine does most of the work. Useful queries:

"@company.com" "Jane Smith"
"Jane Smith" "company.com" email
site:company.com "@company.com"

The third query finds any address published anywhere on the company's site, which is often enough to learn the pattern even if Jane is not listed.

What no longer works: WHOIS. Domain registration records used to show the registrant's email. Under ICANN's Registration Data Policy, effective 21 August 2025, registrant email must be redacted from public lookups, and registrars may publish a pseudonymised address or a web form in its place. Do not waste time there.

4. LinkedIn Contact info

Some members show their email under Contact info, visible by default only to 1st-degree connections. Connect first, then look. The address is whatever they registered with LinkedIn, which is often personal rather than work.

LinkedIn's User Agreement prohibits scraping and bots, so do this by hand. We cover the legitimate methods in detail in finding an email from a LinkedIn profile.

5. Work out the pattern, then verify

Most companies give everyone an address in the same format, so one published address tells you everyone's. This is the method email finders automate.

1. Find any published address at the company: sam.lee@company.com.
2. Identify the format: first.last.
3. Apply it: Jane Smith becomes jane.smith@company.com.
4. Verify it before sending.

The common formats, and how often each appears, are in company email patterns.

Verification is what makes this a method rather than a guess. A verifier asks the company's mail server whether it would accept mail for that mailbox, without sending anything (how that works). The server either confirms it, rejects it, or accepts everything, in which case nobody can confirm it.

How often does the last case happen? More often than most people expect. In the same 337-business sample, we asked each domain's mail server to accept a made-up address (no message sent). Of the 145 servers that gave a definite answer, 93 accepted the made-up address, meaning no address at those domains could be confirmed. Among domains on Google Workspace, 75 of 113 behaved that way. Microsoft 365 servers refused to answer our test network at all, which is its own lesson: whether a check works depends on where it runs from. More on that in how to find a CEO's email.

6. Email finder tools

A finder takes a name and a domain and does method 5 for you, across many patterns, with a verification step. Its value is speed, and its accuracy is exactly as good as that verification step.

Before relying on one, check two things on its pricing page or in its trial:

• What it charges for: every lookup, only verified results, or verified plus catch-all.
• How it labels unconfirmable results. "Valid" on a catch-all domain is a guess with a confident label.

We compared the main tools on published pricing and billing rules in the best email finder tools.

7. Switchboard, reception or contact form

When everything else fails, ask a human at the company. Reception, a general inbox or a contact form will often forward your note or give you the right address. It is slower, but the address you get is confirmed, and at small companies the person answering may be the one you wanted.

Verify before you send

Methods 1 to 4 give you addresses someone published; methods 5 and 6 give you inferences. Inferences go through a verifier, and the result decides what you do:

Verifier result	What it means	What to do
Valid	Mail server confirmed the mailbox	Send
Invalid	Mail server rejected it, or the domain has no mail server	Try the next pattern or method
Risky / catch-all	Domain accepts every address	Send only with other evidence, in a small separate batch
Unknown	Server would not answer	Retry later, or treat as risky

Even published addresses deserve a quick check if the page is old or the address looks wrong. Typos on websites are more common than you would think, and a typo'd address bounces exactly like a bad guess.

You can check single addresses free with our email verifier.

The takeaway

Work down the list and stop at the first method that gives you an address someone published. When you have to infer, learn the company's pattern from a real address, verify the result, and treat anything a mail server would not confirm as risky rather than found.