How to Find a CEO's Email Address (2026): Free Methods That Work, and When Not to Use Them

On this pagev

• First: should you email the CEO at all?
• Where CEOs leave their addresses in public
• The pattern route for startup CEOs
• Doing this for a list, not a person
• What to send once you have it
• Key takeaways

The short answer: for companies under about 50 people, the CEO's email is usually first@domain.com or first.last@domain.com, confirmable in two minutes with an SMTP check, and the CEO genuinely reads what arrives. For larger companies, the address is still findable through the public-trail methods below, but sending to it is usually the wrong move, and the section on that is not a formality. If you are working a list rather than one company, Kustiq returns the decision-maker with an SMTP-verified email from just the domain, and at small companies that contact is typically the founder; 3 free profiles a week, no card.

First: should you email the CEO at all?

The honest size rule, before any technique:

Under ~50 employees: yes. There is no committee. The CEO owns every budget line, reads their own email, and founder-to-founder mail with a specific, relevant point gets answered at rates that would look like typos in enterprise outbound. This is the case the rest of this post optimizes for.

50 to a few hundred: sometimes. The CEO still decides big things but has stopped reading cold mail closely. A short CEO note that gets forwarded down ("worth a look?") can work precisely because internal forwards carry authority, but the primary target should be the function head who owns your problem.

Enterprise: find the address if you like, then do not use it. A cold email to a public-company CEO signals you have not done the work of finding the actual owner. The exception is a genuinely CEO-level matter (partnership, acquisition, press), which, if you have one, usually comes with a warmer path than email anyway.

Where CEOs leave their addresses in public

Executives are the easiest people at any company to find, because they are the ones with a public footprint on purpose. Search the person, not the company:

Personal websites and blogs. Founders keep personal sites with contact pages long after the startup takes off. An address printed there is both real and an invitation.

Podcast and conference pages. Speaker bios and show notes often include contact details, and "reach me at" moments inside episodes are common enough to be worth checking for any CEO who does interviews.

Investor and angel profiles. CEOs who angel-invest list contact details on syndicate and fund pages, because deal flow depends on being reachable.

Press releases and media pages. Smaller companies frequently route press contact through the CEO directly, printing the address in the release footer.

Old footprints. Blog posts, open-source commits, hackathon pages, and university listings from before the current role often carry a personal address that still forwards, or reveal the naming habit the person carries between addresses.

Run these as Google queries: the name in quotes plus "email", the name plus site: their personal domain, the name plus "@company.com". Five minutes of person-searching beats an hour of company-searching for executives specifically.

The pattern route for startup CEOs

When the public trail is thin, the startup CEO pattern space is small:

• first@domain.com, the founder classic, common under 50 employees
• first.last@domain.com, the B2B default at any size
• flast@domain.com, occasionally
• The company-wide format, whatever any printed address at the domain reveals (press, legal, and job pages usually print one)

Generate the candidates, then verify without sending: an SMTP handshake asks the company's mail server whether the mailbox exists and hangs up before any message is transmitted, so nothing lands anywhere. Free single-address checkers run this probe.

The executive-domain caveat, which matters more here than anywhere: CEO addresses attract guessing, so companies concentrate defenses exactly there. In our own SMTP probes, 66.8% of 211 B2B domains were catch-all, meaning the server answers yes for every address, real or invented; a pattern guess on those domains can never be confirmed, only labeled as risk. And a bounced guess at a CEO is the worst version of a bounce: it burns sending reputation and, if variants cascade into real inboxes, announces exactly how you operate. One verified send beats three hopeful ones, at this level more than any other.

Doing this for a list, not a person

The methods above price out at ten to twenty minutes per company. Fine for three; hostile at thirty. For a list, Kustiq Contact Finder takes up to 1,000 companies per batch and returns up to 3 SMTP-verified decision-maker contacts per company at 1 credit per company. Two details matter for the CEO case specifically:

• At small companies, the decision-maker who comes back is typically the founder or CEO, because that is who holds the budget at that size, the same size logic this post opened with, applied automatically.
• Target-role steering lets you say "CEO", "Founder", or "Co-founder" explicitly, so the contacts returned match the level you are actually writing to.

Single companies work too: paste a domain at /try, get the 20-field profile with the verified contact in about a minute, free, no account. Pricing (verified 2026-07-18): 3 free profiles a week; Insight $39/mo for 200 credits; Pro $119/mo for 800; no seat fees.

What to send once you have it

Not the topic of this post, but three rules earn their place because they change whether the address was worth finding:

Shorter than feels safe. CEOs triage; a five-line email with one specific, checkable observation about their company beats any sequence. If you cannot name why them and why now, you are not ready to use the address.

No fake familiarity. "Loved your recent post" with no specifics reads as automation. An actual detail (their pricing change, their new market, their podcast comment) reads as homework, because it is.

One follow-up, then stop. At the CEO level, silence is an answer. The second follow-up converts nothing and gets remembered.

Frequently Asked Questions

How do I find a CEO's email address for free?

Search the person, not the company: personal websites, podcast and conference speaker pages, investor or angel profiles, and press release footers regularly print executive addresses. If the trail is thin, try first@domain and first.last@domain, the two most common startup CEO formats, and confirm with a free SMTP check that asks the mail server whether the mailbox exists without sending anything. Kustiq also returns verified decision-maker contacts free for 3 companies a week.

What is the most common CEO email format?

At startups and small companies, first@domain.com is distinctly common for founders, with first.last@domain.com as the broader B2B default. Whatever format the rest of the company uses (visible from any address printed on press, legal, or careers pages) is the next best guess. Always verify before sending; executive domains are disproportionately catch-all, where a guess cannot be confirmed.

Should I email the CEO or someone else?

Size decides. Under about 50 employees, the CEO is the decision maker and reads their own inbox, so yes. Between 50 and a few hundred, target the head of the relevant function and consider a short CEO note only as a forwarding play. At enterprise scale, a cold CEO email signals skipped homework; find the budget owner instead.

How can I verify a CEO's email without sending anything?

An SMTP handshake: the company's mail server states whether it accepts the exact mailbox before any message is transmitted, and quitting the conversation at that point means nothing is sent and nothing is seen. The caveat is catch-all domains, 66.8% of the 211 B2B domains in our tests, where the server says yes to everything; there the result is honestly unknowable, and tools that label it catch-all are telling the truth while tools that say verified are not.

Do CEOs actually respond to cold emails?

Founders and small-company CEOs do, at meaningfully higher rates than any other title, when the email is short, specific to their company, and obviously written by a person. Response rates fall as company size grows and disappear at enterprise scale. The address is rarely the bottleneck; the specificity of the message is.

Key takeaways

• Size first, address second. Under 50 employees the CEO is the right target; at enterprise scale the findable address is the wrong door.
• Executives self-publish. Personal sites, podcasts, investor profiles, and press footers are where CEO emails actually live; search the person.
• Two patterns cover most startup CEOs: first@ and first.last@, settled by one SMTP check, never by a hopeful send.
• Verification matters most at the top. Catch-all and filtering concentrate on executive domains, and a bounced guess at a CEO is a reputation event, not a rounding error.
• For lists, automate the same logic: domain in, verified founder-level contact out, and spend the saved time making the email worth answering.