How to Find Someone's Business Email (2026): 6 Methods That Still Work

On this pagev

• Before you start: know which problem you have
• Method 1: the company website (2 minutes, free)
• Method 2: LinkedIn (3 minutes, free)
• Method 3: Google search operators (3 minutes, free)
• Method 4: infer the pattern (2 minutes, free, needs verification)
• Method 5: verify before sending (the step that saves your domain)
• Method 6: use a tool (when minutes stop being free)
• The full workflow on one page
• Two etiquette rules that protect you
• Key takeaways

The short answer: start free. The company website, LinkedIn, and a couple of Google search operators find or reveal the pattern for most business email addresses in a few minutes. Then verify before you send, because a bounced guess costs sending reputation you cannot buy back. If you need more than a handful of contacts, or you do not even know who the right person is yet, that is the point where a tool beats the manual routine: Kustiq finds the decision-maker and returns an SMTP-verified address from just the company domain, with 3 free profiles a week, no card. All six methods below, cheapest first.

Before you start: know which problem you have

"Find someone's business email" is two different problems wearing one name.

You know the person. You met them, saw their talk, found their LinkedIn. You need the address for a specific human. Methods 1 through 5 solve this, free.

You know the company. You want to reach "whoever runs sales at that company" but have no name yet. The manual path adds a research step (finding the right person) before any email hunting starts, and the time cost roughly doubles. Method 6 collapses both steps.

Time estimates below assume the first case. If you are in the second, be honest about the extra research time or skip ahead.

Method 1: the company website (2 minutes, free)

Before anything clever, look where addresses are printed on purpose:

• Contact, About, and Team pages, obviously, but also press releases ("media contact: jane.doe@..."), legal and privacy pages (GDPR contacts are often real mailboxes), and job postings (recruiting addresses reveal the domain's format).
• Even one address anywhere on the site gives you the company's pattern: if the press contact is maria.ionescu@company.com, the person you want is very likely firstname.lastname at the same domain.

This is the highest-yield two minutes in the whole process, and most people skip it.

Method 2: LinkedIn (3 minutes, free)

Three places people leak their own work email:

• The Contact info panel on their profile, visible to connections and sometimes to everyone.
• Their posts and comments: people post "reach me at..." more often than you would expect, especially when hiring.
• The company page's posts, which sometimes include contact addresses for events or campaigns.

If the profile shows nothing, LinkedIn still confirms the two inputs the pattern method needs: exact name spelling and current employer. People who changed jobs recently are the top source of bounced guesses, and the profile is where you catch that.

Method 3: Google search operators (3 minutes, free)

Ask Google for the address directly:

"firstname lastname" "@company.com"
"lastname" email site:company.com
"@company.com" site:github.com

The first finds any page where the name and domain appear together (conference bios, papers, event listings). The second searches the company's own site. The third catches developers, whose commit emails and profiles are often public. Swap in variations of the name, and try the person's previous employer domain too if you suspect a recent move.

Method 4: infer the pattern (2 minutes, free, needs verification)

Companies standardize their address format. Once any address at the domain is known (from methods 1 to 3), map it to your target's name. The common formats, in rough order of B2B popularity:

• first.last@company.com
• first@company.com (common at startups)
• flast@company.com
• firstlast@company.com

If you found no address at all, generate the four candidates above and let verification (next method) tell you which format the domain uses. Important honesty note: pattern inference produces a guess. Do not send to a guess.

Method 5: verify before sending (the step that saves your domain)

Every previous method ends with an address you believe in but have not tested. Sending to test it is the one thing you should not do: bounces are recorded against your sending domain's reputation, and enough of them tax the deliverability of everything you send later.

The proper test asks the recipient's mail server whether the mailbox exists, without sending anything: an SMTP handshake, the same conversation every mail delivery starts with, ended before any message is transmitted. Free single-address checkers run this probe, and it is the check behind every serious verification tool.

One structural caveat that most how-to guides omit entirely: catch-all domains. Many companies configure mail to accept every address at their domain, real or invented, which makes the server's yes meaningless. In our own SMTP probes, 66.8% of 211 B2B domains were catch-all. On those domains a pattern guess cannot be verified by anyone, any tool, at any price. The choices there are recovering the real address from public sources (methods 1 to 3, which is why they come first), accepting labeled risk, or finding a different door.

Method 6: use a tool (when minutes stop being free)

The manual path costs 10 to 20 minutes per person when it goes well. Multiply by a list, add the who-is-the-right-person research if you only have company names, and the free method stops being free.

Which tool depends on your starting point (the full B2B email finder comparison goes deeper):

• You have names and companies, need addresses at volume: a pattern-lookup tool like Hunter is the budget pick (about $0.025 per find, 50 free finds a month, verified 2026-07-18). Add a verification step, and remember what pattern lookups can and cannot confirm on catch-all domains.
• You live in LinkedIn: extension tools like Lusha (free tier of 40 credits a month, verified 2026-07-18) turn the profile you are looking at into a contact.
• You have companies, need the right person AND a working address: this is Kustiq's shape. Give it a domain and it reads the company's live web presence, identifies the decision-maker, and returns a contact whose email passed a live SMTP handshake at that moment, with catch-all labeled instead of hidden. One company free to test right now, no account; 3 profiles a week free with one. For a whole list, Contact Finder processes up to 1,000 companies a batch, 1 credit per company, up to 3 verified decision-maker contacts each.

Pricing (verified 2026-07-18): Kustiq free tier is 3 profiles a week; Insight $39/mo for 200 credits; Pro $119/mo for 800. No seat fees.

The full workflow on one page

Two etiquette rules that protect you

One well-researched email beats five guesses. Sending to first.last, flast, AND firstlast at the same domain triples your bounce risk and reads as exactly what it is. Verify first, send once.

Business address, business reason. A work email found through public sources is fair ground for relevant B2B outreach in most jurisdictions, provided the message is honest about who you are and why you are writing, and respects opt-outs. If the reason would embarrass you on the recipient's screen, the address was not the problem.

Frequently Asked Questions

How do I find someone's business email for free?

Four free methods stack well: check the company website (contact, press, legal, and job pages), check the person's LinkedIn contact panel and posts, run Google operators like the name plus the @domain in quotes, and infer the company's address pattern from any address you find. Then verify with a free SMTP checker before sending. Kustiq also gives 3 fully verified profiles a week free, no card.

How do I find someone's work email without knowing the format?

Find any address at the company first: press contacts, legal pages, and job postings usually print one, and that reveals the format. If nothing surfaces, generate the four common formats (first.last, first, flast, firstlast at the domain) and run them through an SMTP verifier; on non-catch-all domains, the format that returns valid is the company's pattern.

How can I check a business email is real without emailing it?

An SMTP handshake: the recipient's mail server states whether it accepts the mailbox before any message is sent, and free checkers run this probe. One major caveat: on catch-all domains, which were 66.8% of the 211 B2B domains in our tests, the server says yes to everything, so a guess there can never be confirmed, only labeled as catch-all risk.

What is the fastest way to find business email addresses for a list of companies?

If you already have names, a pattern-lookup tool at roughly $0.025 per find is the budget route. If you only have the companies, Kustiq Contact Finder takes the list (up to 1,000 companies per batch), identifies up to 3 decision-makers per company, and returns SMTP-verified emails at 1 credit per company, which replaces both the who-research and the address hunt.

Is it legal to find and email someone's business email?

In most jurisdictions, including under GDPR's legitimate-interest basis, contacting a business address found in public sources with relevant, honest B2B outreach is permissible, provided you identify yourself, offer a way to opt out, and honor it. Rules differ for consumer addresses and by country, so check the specifics where your recipients live. Volume-spraying guessed addresses fails both the legal and the deliverability test.

Key takeaways

• The free path is real: company site, LinkedIn, Google operators, pattern inference. Ten to fifteen minutes per known person.
• Never send to an unverified guess. The SMTP check is free and the bounce you avoid is worth more than the minute it takes.
• Catch-all domains cap what anyone can verify. Two thirds of B2B domains in our tests say yes to every address; found beats guessed there, every time.
• Switch to a tool when the input changes from "this person" to "this list" or "this company, whoever is right." That is a different job, and researching it by hand is the expensive way.