Skip to content

How to find someone's work email, and check it's real

Practical ways to find a work email address: company sites, patterns, LinkedIn exports and lead tools, plus how to verify an address without emailing it first.

Fardeen Karim2 min read

If you only need one person's email, you can usually find it for free in a few minutes. If you need thousands, you need a list and a verification step. Whichever it is, a guessed address isn't ready until it has been checked.

Finding one address

1. Look where they published it

Try the company's team, contact and press pages, any blog posts or talks with an author bio, and the person's own website or LinkedIn contact details. An address someone published themselves is the best one you can find, and in some countries, like Canada, that can matter legally too. See is cold email legal.

2. Work out the company's pattern

Most companies use one format for everyone. If you can find one colleague's address, you probably know the rest:

  • first@company.com
  • first.last@company.com
  • flast@company.com
  • firstl@company.com

The free email permutator writes out the likely versions from a name and domain.

3. Check the domain takes email

Before you guess, run the domain through the MX lookup. If it has no mail server, no address on it will work.

4. Verify it before sending

Run your best guess through the email validator for a basic check, or a full verifier for a real one. Don't "test" guesses by sending to all of them: that's how you collect bounces.

Finding many addresses

  1. Define the people first. Industry, company size, location, job title. A tight list beats a big one.
  2. Build the list from a lead database or Sales Navigator search. Here's how I build one.
  3. Remove duplicates and anyone who opted out. The CSV cleaner and suppression builder help.
  4. Verify everything right before you send. Here's how.

Addresses to skip

  • Generic inboxes like info@ and sales@. Nobody in particular reads them, and they get more complaints.
  • Personal addresses. Gmail and Hotmail addresses of business contacts raise more legal and spam risk. Stick to work addresses.
  • Anything scraped from a list that's for sale cheap. It's usually old, and it often holds spam traps.

Catch-all domains

Some companies accept mail for every address, so even a verifier can't tell whether a person exists there. Those addresses come back as "risky" or "catch-all". Decide on a rule beforehand: send to them in small batches and watch bounces, or leave them out. Don't mix them in blindly.

mailzy's lead lists are built from your own Apollo or Sales Navigator search, then verified and de-duplicated, at $25 per 10,000 leads. The email verifier checks lists you already have.

Written by

Fardeen Karim

Founder, mailzy and Web Makeer

Fardeen founded mailzy and Web Makeer and has worked in cold email for 6+ years, sending about 12 million emails for SaaS companies and agencies. He writes about what actually gets replies: setup, deliverability, lists and copy.

Keep reading.

Everything for cold email, in one place.

Start free for 14 days. No card needed.