You've found the perfect prospect. Right company, right title, clear need for your product. One problem: you don't have their email address.
This happens constantly in B2B sales. LinkedIn shows you who to contact but not how to contact them. Company websites hide email addresses behind contact forms. And guessing email patterns leads to bounces that hurt your sender reputation.
Here are five methods that actually work to find work emails in 2026 - from free techniques to automation tools.
Method 1: Email Pattern Detection
Most companies use predictable email formats. If you know the pattern, you can construct the email address.
Common patterns
| Pattern | Example | Prevalence |
|---|---|---|
| firstname.lastname@ | john.smith@company.com | 35% |
| firstnamelastname@ | johnsmith@company.com | 20% |
| firstname@ | john@company.com | 15% |
| flastname@ | jsmith@company.com | 12% |
| firstnamel@ | johns@company.com | 8% |
| lastname.firstname@ | smith.john@company.com | 5% |
| Other variations | Various | 5% |
How to find the pattern
-
Check existing contacts: If you have anyone from that company in your CRM, look at their email format.
-
Search Google: Search "site:company.com @company.com email" to find emails listed publicly.
-
Check LinkedIn posts: People sometimes share their email in posts or comments.
-
Look at press releases: Company PR often includes contact emails that reveal the pattern.
Construct and verify
Once you have the pattern:
- Construct the email: firstname.lastname@company.com
- Verify before sending (more on this below)
Don't Guess and Send
Never send to an email you haven't verified. Guessing creates bounces that damage your sender reputation. One wrong email affects deliverability on every future send.
Method 2: LinkedIn Search + Enrichment
LinkedIn tells you who works where. Enrichment tools tell you how to reach them.
The workflow
- Find the person on LinkedIn: Search by company, title, or name.
- Grab the LinkedIn URL: Copy their profile URL.
- Run enrichment: Paste the URL into an enrichment tool (here's how to enrich LinkedIn leads safely).
- Get verified email: Tool returns verified work email (and often phone).
Why this works
Enrichment tools like Cleanlist query multiple data sources to find verified contact information. They don't guess - they lookup and verify.
The enrichment process:
- Match LinkedIn profile to data records
- Query 15+ data providers for email
- Verify email exists (SMTP check)
- Check deliverability (is mailbox active?)
- Return only verified results
Bulk LinkedIn enrichment
For prospecting at scale, use Sales Navigator Scraper:
- Build a search in Sales Navigator
- Export to Cleanlist
- All profiles enriched automatically
- Download complete contact list
This turns hours of manual lookup into minutes of automated enrichment.
Method 3: Company Website Investigation
Sometimes the email is hiding in plain sight.
Where to look
Team/About page: Some companies list leadership emails publicly.
Press/News page: PR contacts often reveal email patterns.
Contact page: Look for department-specific emails that reveal the format.
Job postings: Application instructions sometimes include an email.
Privacy policy/Terms: Legal documents sometimes include contact emails.
Domain WHOIS: Check who registered the domain (though often privacy-protected now).
Check page source
Some websites have emails in the HTML that aren't displayed:
- Right-click on the page
- Select "View Page Source"
- Search (Ctrl+F) for "@" or "mailto:"
Emails in source code often aren't visible on the rendered page.
Search operators
Use Google to search within the company's website:
site:company.com email
site:company.com "contact"
site:company.com "@company.com"
"@company.com" "name of person"
Method 4: Mutual Connections and Warm Intros
Sometimes the best way to get an email is to ask.
Check for mutual connections
On LinkedIn:
- View the prospect's profile
- Look for mutual connections
- Ask a mutual connection for an introduction
A warm intro is more valuable than a cold email anyway.
Ask your network
Post on LinkedIn or Slack communities:
- "Anyone connected to [person] at [company]?"
- "Looking for the right contact at [company] for [use case]"
Your network often knows people you're trying to reach.
Use the company's chatbot
Many companies have website chatbots. Ask:
- "Who handles [relevant area]?"
- "What's the best email for [department]?"
Chatbots sometimes reveal contact information freely.
Method 5: Waterfall Enrichment Tools
For consistent, scalable email finding, use a waterfall enrichment tool.
How waterfall enrichment works
Instead of querying one data source (which has gaps), waterfall enrichment queries multiple sources in sequence:
- Query Provider 1 → Found email? Verify it.
- No email? Query Provider 2 → Found email? Verify it.
- Continue through 15+ providers
- Return the verified email from whichever source found it
This approach achieves 80-90% coverage, compared to 50-60% from single-source tools.
What to look for in an enrichment tool
| Feature | Why It Matters |
|---|---|
| Multiple data sources | Higher coverage, fewer gaps |
| Email verification | Only returns deliverable emails |
| Catch-all detection | Flags risky domains |
| Direct dial phones | Multi-channel outreach |
| CRM integration | Automatic enrichment on lead creation |
Cleanlist enrichment
Cleanlist's waterfall enrichment provides:
- 15+ premium data sources
- 98% email accuracy
- 85% phone find rate
- Real-time verification
- 1 credit for email-only, 11 credits for full contact
Pro Tip
Set up automatic enrichment so new leads are enriched as they enter your CRM. No manual lookups required.
Email Verification: The Critical Step
Finding an email is only half the battle. Verifying it is equally important.
Why verification matters
- Protects sender reputation: Bounces damage your domain's ability to reach inboxes
- Saves credits: Don't spend outreach resources on invalid addresses
- Improves metrics: Higher deliverability = better open and response rates
What verification checks
Good verification tools check:
- Syntax: Is the email properly formatted?
- Domain: Does the domain exist? Does it accept email?
- Mailbox: Does this specific mailbox exist?
- Deliverability: Is the mailbox active and accepting email?
- Catch-all: Does the domain accept all emails (risky)?
Verification results
| Status | Meaning | Action |
|---|---|---|
| Valid | Email exists and is deliverable | Safe to email |
| Invalid | Email doesn't exist | Do not email |
| Catch-all | Domain accepts all, can't verify specific mailbox | Email with caution |
| Unknown | Couldn't verify (temporary issue) | Retry later |
Compliance Considerations
Finding emails is easy. Using them legally requires attention.
CAN-SPAM (US)
- Must include physical address
- Must have unsubscribe mechanism
- Must honor opt-out requests
- Cannot use deceptive headers or subject lines
GDPR (EU)
- Need legitimate interest or consent basis
- Must disclose how you obtained contact
- Must provide way to access/delete data
- Higher scrutiny on purchased data
Best practices
- Only email for legitimate business purposes
- Make it easy to unsubscribe
- Don't email people who opted out
- Keep records of where you obtained emails
Scaling Email Finding
For sales teams doing consistent outreach, manual methods don't scale.
Build a repeatable process
- Define target list: ICP criteria, target accounts
- Find contacts: LinkedIn search for relevant titles
- Bulk enrich: Upload to Cleanlist, get verified emails
- Verify: Ensure all emails pass verification
- Segment: Group by priority, persona, account tier
- Outreach: Send personalized sequences
Automate where possible
- CRM integration: Enrich leads automatically on creation
- Sales Nav Scraper: Export and enrich LinkedIn searches
- Webhooks: Push enriched data to outreach tools automatically
Frequently Asked Questions
What's the best free method to find emails?
Email pattern detection + Google searching is free but time-consuming. For occasional lookups, it works. For consistent prospecting, the time cost exceeds the subscription cost of enrichment tools.
How accurate are email finder tools?
Single-source tools: 60-70% accuracy. Waterfall enrichment tools querying multiple sources: 95%+ accuracy. The difference is verification - good tools only return emails they've verified exist.
Can I use personal emails for B2B outreach?
Technically yes, but it's less effective. Personal emails (Gmail, Yahoo) signal the person isn't at a work account. Work emails have higher response rates and reach the person in professional context.
How do I find emails for small companies?
Small companies are harder - less data available. Try: company website investigation, LinkedIn + enrichment, pattern detection from any known email, or reaching out via LinkedIn message to request email.
What if the email bounces after verification?
This happens occasionally (person left company between verification and send). Good tools have 98%+ accuracy, so bounces should be rare. If you see consistent bounces, your data source may be stale - consider re-verifying.
Finding work emails doesn't have to be a manual slog. Use waterfall enrichment to find verified emails at scale, and spend your time on outreach instead of research. If you're building outbound lists for your sales team, start with a free trial.