How to Find Someone's Email Address: 15 Methods That Work in 2026

Why finding B2B email addresses is harder than it used to be

The quickest way to find someone’s email for B2B outreach is to enter their name and company domain into an email finder tool, which cross-checks public records and verified databases to return a working address in seconds. That’s the short answer. But it’s worth understanding why this task got harder in the first place, because it shapes which method you’ll actually need.

A few years ago, most company websites listed staff emails right on the team page. Not anymore. Privacy concerns and spam prevention pushed most businesses toward contact forms or generic inboxes like info@ or sales@, neither of which reach a specific decision-maker.

On top of that, B2B email lists decay fast. People change jobs, companies merge, domains get retired.

• •

  Average monthly decay: B2B email databases lose about 2.1% of valid addresses per month, which compounds to roughly 22.5% per year (Instantly.ai)

• •

  Faster-moving sectors: some industries see decay rates closer to 3.6% per month, meaning a list can lose a third of its value within a year (Instantly.ai)

So even a perfectly accurate list today might be a third wrong by next year. That’s exactly why knowing multiple methods, not just one favorite tool, matters.

How to pick the right email finding method for your situation

Not every technique fits every job. If you need one email right now, manual lookup works fine and costs nothing. If you’re building a list of hundreds, you’ll want something faster.

Once you’re past roughly 20 contacts, manual research usually costs you more in time than a finder tool would cost in dollars. Worth keeping in mind before you spend an afternoon Googling names one by one.

15 proven techniques to find someone’s business email address

These move from free and manual to paid and automated. Start wherever fits your volume and timeline.

1. Check LinkedIn contact info. Click the link icon below someone’s name and headline. Many professionals list a work email here, though plenty leave it blank or show a personal Gmail instead.

2. Search the company website’s team or press pages. Leadership bios and press kits sometimes include direct emails, and PR contacts usually follow the same format as everyone else at the company.

3. Use Google search operators. Try "first last" "@company.com" or site:company.com "first last" email. Adding filetype:pdf sometimes turns up emails buried in whitepapers or speaker lists.

4. Guess the email pattern, then verify it. Most companies use one consistent format for every employee. If you find one confirmed email, you can infer the rest.

• •

  first.last@company.com

• •

  firstinitiallast@company.com

• •

  first@company.com

• •

  first_last@company.com

5. Use an email permutator. This generates every likely combination of a name and domain, which you then run through a verifier to find the live one. Handy when you can’t confirm the company’s pattern any other way.

6. Try a B2B email finder Chrome extension. Unlike checking LinkedIn manually (technique 1), extensions like Kaspr run a live lookup against external databases as you browse profiles or Sales Navigator results (PhantomBuster). Most cap free lookups at a small number per month.

7. Check Twitter/X, GitHub, and speaker bios. Developers often list emails on GitHub. Founders sometimes drop theirs in a Twitter bio. Easy to overlook, occasionally the only place an address shows up.

8. Run a single-lookup email finder tool. Tools like Hunter or Snov.io take a name and domain and return a verified match in one search (Hunter.io, Snov.io). Good when you need exactly one contact, fast.

9. Search a B2B contact database with ICP filters. ICP stands for ideal customer profile, and filtering by job title, industry, or tech stack narrows a database to the contacts that actually fit your target. Apollo works this way, and lemlist’s own database covers over 600 million contacts with filters for funding, hiring trends, and tech stack.

10. Enrich an existing list with waterfall enrichment. This method queries several data providers one after another until it finds a verified email, instead of giving up after the first source fails (FullEnrich). Ideal if you already have names and companies but no emails.

11. Ask an AI tool like ChatGPT or Claude. These can surface publicly listed emails, though results occasionally include addresses that don’t actually exist. Treat it as a starting point, not a final answer, and verify everything.

12. Check newsletter archives and mailing lists. Some companies publish past newsletters with author emails attached. Niche, but it works often enough to be worth a quick check.

13. Look at podcast guest bios and conference speaker pages. Event sites and show notes frequently list direct contact details, especially for executives who do public speaking.

14. Ask for an intro through a mutual connection. A warm intro tends to convert better than cold email, and it often hands you the correct address along the way.

15. Send a short LinkedIn message asking for their email. When nothing else works, this is direct and usually gets a reply. Keep it to two sentences, and it doubles as a soft qualifier for interest.

How to verify email addresses before you send

Finding the email only solves half the problem. Sending to a dead address creates a hard bounce, and a 10,000-contact list loses somewhere between 2,250 and 3,000 valid addresses a year, even if it just sits untouched (Instantly.ai). That kind of decay hits your sender reputation directly, not just your reply rate.

A proper check runs through four layers:

• •

  Syntax check: confirms the address follows valid formatting, no stray spaces or missing @ symbols

• •

  MX record lookup: confirms the domain actually has a working mail server

• •

  SMTP validation: pings the specific mailbox to see if it exists, without sending anything

• •

  Catch-all detection: flags domains that accept mail at any address, meaning “valid” doesn’t guarantee a real inbox

Tip: verify right before you send a campaign, not just when you first collect the address. Decay happens continuously, so a list that checked out clean three months ago can already have gaps today.

How waterfall enrichment increases your email find rate

Most teams run into the same wall. You build a list, run it through one provider, and get results for maybe half. The rest aren’t uncontactable, your tool just didn’t check anywhere else.

Waterfall enrichment fixes that by querying providers in sequence, and it typically finds around 80% of contacts compared to 50 to 60% from a single source (FullEnrich). Each provider covers different regions, industries, and company sizes, so the second or third one often catches what the first missed.

lemlist’s Email Finder runs waterfall enrichment across 14+ premium data providers, and you’re only charged for verified results. Finding, verifying, and launching outreach all happen in one place.

What to do after you find the email

Personalize using enrichment data. Most finder tools return more than just the email, they also surface job title, company size, or recent funding. Use that to write an opening line that’s specific to the person, not a copy-paste template.

Add channels beyond email. Pairing email with LinkedIn messages, calls, or SMS tends to lift reply rates. Running all of it from one platform keeps your timing and messaging consistent, instead of juggling tabs.

Time it to intent signals. An intent signal is any sign someone’s more likely to respond right now, a job change, a funding round, new hiring. Even a perfect email address underperforms if you send it at the wrong moment.

Cold email compliance across GDPR, CAN-SPAM, and CASL

Having someone’s email doesn’t automatically mean you’re free to use it. The rules depend on where the recipient sits, not where you’re sending from.

CAN-SPAM (US) allows unsolicited commercial email as long as you include a physical address, a clear unsubscribe option, and an honest subject line. No opt-in required beforehand, though violations can carry fines up to $51,744 per email.

GDPR (EU) requires a legal basis for contacting someone, and “legitimate interest” is the most common one B2B senders rely on. It’s worth documenting why the contact fits your ICP, and honoring opt-outs right away.

CASL (Canada) is stricter, generally requiring implied or express consent before you send. A published business email or an existing relationship usually counts as implied consent. A few other countries, Australia and Brazil among them, fall somewhere between CAN-SPAM and GDPR in how strict they are.

Find verified B2B emails and launch outreach from one platform

Switching between four separate tools for finding, verifying, enriching, and sending slows everything down. lemlist combines all of it: search a 600M+ contact database, run waterfall verification across 14+ providers, and push results straight into multichannel campaigns across email, LinkedIn, calls, and WhatsApp.