How to Find Company Email Addresses (2026)
The three methods that actually find a work email, and the verify step that keeps unverified sends from wrecking your domain.
How to Find Company Email Addresses (2026)
To find company email addresses in 2026, infer the domain's email pattern from one known address, look the person up in an email-finder or enrichment tool seeded with their name and company, then verify every address before you send. Finding the email is the easy part. The verify step and picking the right person are what actually matter.
Most guides on how to find company email addresses are tool-affiliate roundups that stop the moment they hand you an address. That is the wrong place to stop. Finding a work email is trivial and nearly worthless on its own. The address is only as good as the reason you have to send, whether it belongs to the right decision-maker, and whether it will actually land in an inbox instead of quietly torching your domain reputation.
This guide covers the three methods that reliably find a business email address, the non-negotiable verify step, and the deliverability and legality lines that the vendor roundups skip.
The 5 ways to find a work email that actually work
Pattern inference beats every paid tool for a single target. Here is the order to try, from most reliable to last resort.
- Find one known address at the domain. Check the site footer, contact page, press page, or a team member's public bio. One real address like
press@company.comorjane.doe@company.comreveals the format. - Infer the pattern and apply it. Most companies use one of a handful of formats:
firstname.lastname@,firstinitiallastname@,firstname@, orflast@. Apply the observed format to your target's full name. - Do a provider lookup. Check the domain's MX records to see who hosts mail (Google Workspace, Microsoft 365, or a catch-all). This tells you whether a mailbox-level verification will even return a truthful answer.
- Enrich from a verified name. Seed an email finder tool or enrichment API with the person's full name plus the company domain. This is where finders earn their keep: turning a confirmed identity into an address.
- Verify every candidate before sending. Run each address through an SMTP or MX check. An unverified guess is a liability, not a lead.
Do not skip straight to a scraper that dumps 500 addresses off a domain. For seed and early B2B outreach, one verified decision-maker is worth more than a full-domain list of role accounts and stale mailboxes.
Find the email from a name and company: pattern first
The fastest way to find an email from a name and company is to steal the format, not guess the person. Companies are internally consistent. If sarah.chen@acme.com bounces back clean, then tom.rivera@acme.com almost certainly exists.
The four dominant patterns, in rough order of prevalence:
| Pattern | Example for "Tom Rivera" | Where it shows up |
|---|---|---|
| firstname.lastname | tom.rivera@ | Larger, structured orgs |
| firstinitiallastname | trivera@ | Common at mid-size B2B |
| firstname | tom@ | Small teams, early startups |
| firstinitial.lastname | t.rivera@ | Occasional, European orgs |
At a 0-3-customer stage you are usually emailing small companies, where firstname@company.com is more common than at enterprises. Try that first for a lean startup target. If you cannot find a single known address to anchor the pattern, that is the moment to reach for a finder or enrichment tool, not before.
Verify before sending, or you kill your own domain
The verify step is the whole game, and it is the step every tool-roundup buries. A guessed address that bounces does not just fail to reach one person. It signals to inbox providers that you are sending to lists you have not cleaned, and that reputation hit follows every future email from your domain.
Keep your bounce rate low. OpenVC's 2026 guide sets the target bounce rate for outbound investor email at under 1%, meaning fewer than 1 in 100 sends should bounce, specifically to protect the sending domain's reputation (OpenVC , How to Cold Email Investors). The same math applies to B2B customer outreach: providers punish domains that miss it.
Verification has one trap you have to understand: the catch-all domain.
ā Good: A mailbox-level verify returns "valid, not catch-all." The address exists and the domain rejects fakes, so a clean result means a real inbox. ā Bad: A catch-all domain returns "valid" for
asdfgh@company.com. Catch-alls accept everything, so "verified" tells you nothing, and you can still bounce or hit an unmonitored trap.
For catch-all domains, verification cannot confirm the mailbox exists. Treat catch-all "valid" results as unconfirmed, lean harder on pattern inference from a genuinely known address, and never blast a catch-all domain with guessed permutations.
Right person beats full-domain scrape
One verified decision-maker at the right company outperforms a 500-address unverified dump every time for early-stage outreach. The affiliate guides implicitly tell you to scrape as many addresses as possible. That advice is built for spray-and-pray volume sellers, not founders finding their first ten customers.
Role-based addresses (info@, sales@, contact@) are the worst of both worlds: they are easy to find, so everyone emails them, and they route to a shared queue no decision-maker reads. A personal mailbox for the actual buyer, verified and sent to with a specific reason, beats twenty role accounts.
This is also where cold outreach is legitimately working right now. a16z's 2025 essay on young founders observes that in the current environment "buyers are more likely to respond to cold emails" (a16z , Why Now Is a Special Time for Young Founders). A well-targeted single send lands. If you are enriching and verifying more than a few dozen decision-makers a week, tools like Causo do the finding and verification in one pass so every address on your list is a real person with a real reason to hear from you.
A plain-English take on the legality line
Cold B2B email to a work address is legal in the US and EU when you follow the rules, and the rules are not complicated. Under US CAN-SPAM, unsolicited B2B email is permitted if you identify yourself honestly, avoid deceptive subject lines and headers, and honor opt-out requests. Under EU and UK GDPR, cold B2B outreach is generally defensible under legitimate interest when you target a person in their work capacity and give them a clear way to opt out.
The distinction that matters: a work address at a company domain is a business contact in a business context. A personal address at gmail.com or outlook.com is not, and it carries more consent risk. Stick to verified work addresses, keep records of why you contacted each person, and this stays clean. None of this is legal advice, so check with counsel for your jurisdiction.
From ICP to inbox without the ten tabs
Everything above is manual work that scales badly: find one known address, read the pattern, enrich the person, verify the mailbox, then repeat across every account you care about. The bottleneck is not finding an email, it is doing find, enrich, and verify for the right person at every company that matches your buyer. That is the job a stale scraped list from Apollo or ZoomInfo cannot do, because it hands you an aged database instead of the companies that fit you today.
Causo runs that whole loop from a description of your ideal customer. You describe the ICP and it researches the live open internet for matching companies and their actual decision-makers, returning verified emails rather than guessed permutations off a domain. No juggling a finder in one tab, a verifier in another, and LinkedIn in a third.
Because it keeps a human in the loop, you review the list and the drafts before anything sends. It writes the first-touch outreach in your own voice and leaves the send decision to you, so every address on the list is a real person you have a real reason to contact, verified on the way in.
FAQ
How do I find someone's company email address? Start with the company's known email pattern. Find one confirmed address at the domain (a support or press contact), infer the format like firstname.lastname@company.com, apply it to your target's name, then verify the guess with an SMTP or MX check before you send. If pattern inference fails, use an email finder or enrichment tool seeded with the person's full name and company domain.
How do I find a work email for free? Free methods work for low volume. Check the company's site footer, contact page, and team bios, search the person's name plus "email" or plus the domain, and look at their public LinkedIn or GitHub. Then infer the domain pattern from one known address and verify manually. Free finder tiers exist but cap monthly lookups, so they suit a handful of targets, not a list of hundreds.
How do you verify an email is valid? Verification checks that the domain has mail servers (MX records) and that the specific mailbox will accept mail, without sending a real message. A clean result means the address is likely deliverable. A catch-all domain accepts everything, so it returns "valid" even for addresses that do not exist, which is why catch-all hits still carry bounce risk.
Is it legal to email someone's work address? In the US, CAN-SPAM permits unsolicited B2B email if you identify yourself, do not use deceptive headers, and honor opt-outs. In the EU and UK, GDPR allows cold B2B outreach under legitimate interest when you target a person's work role and let them opt out. Emailing a personal address (gmail.com, outlook.com) is a different and riskier category. Consult counsel for your specifics.
What is the most common email pattern at a company (firstname.lastname vs. firstinitial.lastname)? firstname.lastname@company.com is the most common format at structured mid-size and larger companies, while firstname@company.com dominates at small early-stage teams. The reliable move is not to assume: find one confirmed address at the domain, read the format off it, and apply that same format to your target's name.
Related on the hub
- How to find investors for your startup (2026) ā for when the playbook turns into a raise.
- Apollo Alternatives 2026: 11 Best for Founder Sales ā Related cold outreach guide.
- Best B2B Lead Generation Tools 2026: 15 for Founders ā Related cold outreach guide.
- How to Find B2B Leads: A Founder's Guide (2026) ā Related cold outreach guide.