How to Find Anyone's Email Address: CEO, CFO, VP & More [2026] | Cleanlist

Finding someone's email address used to be simple. You searched their name plus company, and a contact page or LinkedIn profile gave you what you needed. In 2026, that approach fails more often than it works. Privacy regulations have tightened. Companies hide executive emails behind contact forms. Email cloaking tools scrub addresses from public web pages. And the executives you most need to reach — CEOs, CFOs, VPs — are the hardest to find because they are the most aggressively protected.

The problem is measurable. According to Salesforce's State of Sales report, sales reps spend 28% of their week on non-selling activities, with prospecting research consuming the largest share. For a team of 10 reps, that translates to roughly 560 hours per month spent searching for contact information instead of selling. Every hour spent manually hunting for an email is an hour not spent in a prospect's inbox.

This guide covers seven methods to find any professional's email — from free techniques you can use right now to automation tools that find 94% of target emails across thousands of contacts. Each method has different strengths depending on whether you need one email or one thousand, and whether you are targeting a specific executive or building a prospecting list.

We tested all seven methods on a list of 500 B2B contacts across industries and seniority levels. The results ranged from 23% success (social media mining alone) to 94% (waterfall enrichment). The right method depends on your volume, budget, and how quickly you need the data.

“The average B2B sales rep spends 17% of their time just searching for contact information — that is nearly a full day per week. The teams that eliminate this bottleneck by automating email discovery and verification are the ones consistently hitting quota while everyone else is still copy-pasting from LinkedIn.”

Why Finding Executive Emails Is Harder in 2026

Finding a CEO's email address or a VP's direct contact has become significantly harder over the past two years. Four trends are driving this.

Privacy regulations are expanding. GDPR enforcement in Europe has fined companies over 4.5 billion euros since 2018, and CAN-SPAM, CCPA, and Canada's CASL now carry real enforcement risk. Companies respond by removing employee emails from public-facing pages and routing all contact through web forms or chatbots.

Email cloaking is standard practice. Tools like Cloudflare's email obfuscation, which replaces visible email addresses with encoded JavaScript, are now deployed on over 25 million websites. If you inspect a company's contact page and find encoded characters instead of an email address, cloaking is the reason.

Security teams actively scrub executive contact data. At companies with 200+ employees, IT security policies often include monitoring and removing executive email addresses from data broker databases, public directories, and aggregation sites. The higher the seniority, the more aggressively the address is protected.

Spam filters and bounce protections are smarter. Sending to a guessed email that does not exist now triggers faster reputation penalties than it did two years ago. Google and Microsoft have tightened bounce-rate thresholds, and catch-all domains — which used to accept any email — are increasingly being replaced by strict mailbox verification. Guessing without verifying is riskier than ever. Proper email verification before sending is no longer optional.

The good news: these protections make it harder to guess, but they do not make it impossible to find. The methods below work within these constraints.

7 Methods to Find Anyone's Email Address

Each method below works differently and has different trade-offs on accuracy, speed, and cost. We ranked them by practical success rate based on our test of 500 B2B contacts.

Method 1: Email Pattern Detection

Most companies use a consistent email format across the organization. If you can identify the pattern, you can construct any employee's email address with reasonable confidence.

How it works: Identify one known email address at the target company, extract the pattern, and apply it to the person you are trying to reach.

Common email patterns

How to find the pattern

1. Check your CRM. If anyone at your company has ever contacted anyone at the target company, that email reveals the pattern. Search your CRM and email history first.
2. Search Google. Use "@company.com" to find publicly listed emails from that domain. Press releases, job postings, and support pages often expose the format.
3. Check LinkedIn posts and comments. Employees sometimes share their email in posts, articles, or comment threads.
4. Look at press releases. Media contacts on company PR pages almost always include a real email address that reveals the format.
5. Use a pattern-detection tool. Tools like Hunter.io and Clearbit Connect identify the most common email format for any domain.

Construct and verify

Once you know the pattern, construct the email: if the format is firstname.lastname@company.com and you are targeting Sarah Chen, the address is sarah.chen@company.com.

Critical step: verify before sending. Never send to a constructed email without verification. Even if the pattern is correct, the person may have left the company, use a different variation, or have a mailbox alias. Run the address through Cleanlist's email verifier or another verification tool to confirm deliverability. One bounced email to a CEO hurts your domain reputation more than ten bounced emails to generic addresses.

Success rate: ~60%. Pattern detection works well at mid-to-large companies with standardized email formats. It fails at small companies where founders use personal Gmail accounts, at companies with inconsistent formats, and when the target has a common name (multiple John Smiths at the same company).

Method 2: LinkedIn Profile Enrichment

LinkedIn is the most reliable source for confirming that a person works at a specific company with a specific title. Enrichment tools then translate that LinkedIn profile into verified contact data.

How it works: You find the person on LinkedIn, copy their profile URL, and feed it into an enrichment tool that matches the profile to contact records across multiple data sources.

Step-by-step workflow

1. Find the person on LinkedIn. Search by name, company, and title. LinkedIn Sales Navigator gives you advanced filters by seniority, department, geography, and company size.
2. Copy the LinkedIn URL. Grab the profile URL (e.g., linkedin.com/in/sarahchen).
3. Run enrichment. Paste the URL into Cleanlist or another enrichment tool. Here is a detailed guide on how to enrich LinkedIn leads safely.
4. Get verified results. The tool returns a verified work email, often with direct dial phone, company firmographics, and seniority data.

Why this method is strong

Enrichment tools do not guess. They query live databases and verify results against mail servers. Cleanlist's waterfall approach routes the lookup through 15+ data providers — if the first three providers do not have the email, the next twelve still get a chance.

The result: 85% success on individual LinkedIn profile lookups, with 98% accuracy on the emails that are returned. Compare that to pattern detection, where you get a higher "coverage" but lower confidence that the address is actually deliverable.

Bulk LinkedIn enrichment

For prospecting at scale, export a LinkedIn Sales Navigator search into a CSV and upload to Cleanlist for bulk enrichment. A 1,000-contact list typically takes under 5 minutes and returns verified emails for 850+ contacts. See our full guide on building a B2B lead list for the complete workflow.

Success rate: ~85% for individual lookups. Higher at well-known companies, lower for early-stage startups with fewer than 20 employees.

Method 3: Company Domain Search

Domain search tools return all known email addresses associated with a company domain. Instead of searching for one person, you get everyone — then filter to the contact you need.

How it works: Enter a company domain (e.g., acme.com) and the tool returns all email addresses it has found associated with that domain, along with the person's name, title, and confidence score.

When to use domain search

• You know the company but not the exact person
• You want to find multiple contacts at the same account
• You are building a target account list and need to identify decision-makers

Tools for domain search

• Hunter.io — Free tier includes 25 searches per month. Returns emails with confidence scores and sources.
• Snov.io — 50 free credits per month. Returns emails and allows drip campaigns from the same platform.
• Cleanlist — Waterfall enrichment searches 15+ provider databases per domain, returning results that single-source tools miss. 30 free credits.

Limitations

Domain search returns emails that the tool has indexed. If a company's executives have never appeared in any data provider's database — common for small, newly founded companies — domain search returns nothing. It is also weak for companies that use generic domains (like Gmail or Outlook) rather than corporate domains.

Success rate: ~70% for companies with 50+ employees. Drops to under 40% for companies under 10 employees.

Method 4: Google Advanced Search Operators

Google indexes more publicly available email addresses than any commercial database. The trick is knowing how to search.

How it works: Use Google's advanced search operators to find email addresses published on websites, in PDFs, on social media profiles, and in online directories.

Search queries that work

Find emails on a company's website:

site:acme.com "@acme.com"

Find a specific person's email:

"Sarah Chen" "@acme.com"

Find emails in PDFs and documents:

"@acme.com" filetype:pdf

Find emails from press releases:

"acme.com" "media contact" email

Find emails in conference speaker lists:

"Sarah Chen" "acme" email OR contact

Find emails on GitHub:

site:github.com "@acme.com"

Pro tips for Google search

• Use quotes around the email domain to get exact matches rather than approximate results.
• Add the person's full name in quotes to narrow results.
• Search cached versions if the live page has removed the email. Click the three dots next to a result and select "Cached" to see older versions.
• Search industry directories like Crunchbase, AngelList, and Product Hunt, where founders often list contact information.

Limitations

Google search is slow. It works for one or two emails but does not scale for prospecting lists. The information you find may also be outdated — the email might have been valid when the page was published but the person has since changed roles or companies. Always verify any email found through Google before sending.

Success rate: ~35%. Highly variable — works well for founders and public figures, poorly for mid-level employees at large companies.

Method 5: Social Media and Content Mining

Professionals who create public content — conference speakers, podcast guests, blog authors, open-source contributors — often leave their email address attached to that content.

How it works: Search platforms where professionals share contact information publicly, either intentionally (speaker bios, author profiles) or incidentally (GitHub commits, podcast show notes).

Where to find emails by platform

Twitter/X: Check bios, pinned tweets, and link-in-bio pages. Many executives include their email or a Calendly link in their bio.

GitHub: Developer profiles often list an email address. Even better, Git commit history contains the committer's email. For technical executives (CTOs, VPs of Engineering), this is a reliable source.

Conference speaker pages: Events like SaaStr, Web Summit, and industry conferences publish speaker bios that frequently include email addresses. Search "Sarah Chen" speaker email or check the event's agenda page directly.

Podcast show notes: Guests on B2B podcasts often share their email or LinkedIn in the show notes. Search "Sarah Chen" podcast to find appearances.

Medium and Substack: Authors on these platforms sometimes include their email in article bios or about pages.

YouTube: Check video descriptions and channel about pages. Many B2B content creators list business email addresses.

Limitations

This method only works for people who create or appear in public content. It is excellent for VPs of Marketing and founders (who tend to be visible) and weak for CFOs, operations leaders, and mid-level managers (who tend to be invisible online).

Success rate: ~23% overall, but rises to 50-60% for VPs of Marketing and founders who actively publish content.

Method 6: Mutual Connections and Referrals

The most underrated method. A warm introduction yields a 5x higher response rate than any cold email, regardless of how accurate the email address is.

How it works: Use your existing network to get introduced to the person you are trying to reach, or to get their email directly from someone who already knows them.

Step-by-step process

1. Check LinkedIn for mutual connections. View the target person's LinkedIn profile. LinkedIn shows shared connections. If you have a mutual connection, that person can introduce you.
2. Ask directly. Message the mutual connection: "I am trying to reach Sarah Chen at Acme about [specific reason]. Would you be open to making an introduction?" Be specific about why — vague requests get ignored.
3. Use LinkedIn InMail as a backup. If you have no mutual connections, InMail reaches the person directly. Personalize heavily — reference their recent posts, company news, or shared interests.
4. Try company chatbots. Many companies deploy website chatbots that will connect you to the right person or provide department-specific email addresses.
5. Post in relevant communities. Slack groups, Discord servers, and LinkedIn groups for your industry often have members who can connect you. A post like "Looking for the right contact at Acme for [use case] — anyone connected?" frequently works.

Why warm intros outperform

Cold emails average a 1-3% reply rate. Warm introductions average 15-25%, according to LinkedIn's own data. Even if finding the email takes longer through a referral, the conversion rate makes it worthwhile for high-value targets like CEOs and enterprise decision-makers.

Success rate: ~45% for getting the email address. But the emails you do get convert at 5-8x the rate of cold outreach, making this the highest-ROI method for individual high-value targets.

Method 7: Waterfall Enrichment (Multi-Source)

Waterfall enrichment is the most reliable method for finding email addresses at scale. Instead of relying on one database, it queries 15+ data providers in sequence until a verified email is found.

How it works: You provide a person's name, company, and optionally their LinkedIn URL or domain. The waterfall system queries Provider A — if no result, it moves to Provider B, then C, through 15+ sources. Every email found is verified against the mail server in real-time before being returned.

Why waterfall beats single-source tools

Every data provider has coverage gaps. Apollo might have strong data on tech startups but weak coverage of healthcare companies. ZoomInfo excels at enterprise but misses SMBs. Hunter indexes publicly available emails but cannot verify private addresses.

A single-source tool delivers 50-60% email coverage. A waterfall that chains 15+ providers delivers 94%.

The math is straightforward:

For a 1,000-contact prospecting list, that is the difference between 400 deliverable emails and 900 deliverable emails. The revenue impact compounds from there.

How Cleanlist waterfall works

1. Upload your list or connect via API with name, company, domain, or LinkedIn URL
2. Waterfall queries 15+ providers — each record is routed through the full provider chain
3. Real-time SMTP verification — every email is verified against the actual mail server
4. Catch-all and risk detection — risky addresses are flagged, not just marked "valid"
5. Results returned in minutes — a 1,000-record list completes in under 5 minutes

Cleanlist starts at $29/mo with 30 free credits. Credit-based pricing means you pay per contact enriched, not per seat. See pricing details.

Success rate: ~94% email found rate with 98% accuracy on returned emails. The highest of any method, and the only one that scales to thousands of contacts without manual work.

How to Find a Founder's Email

Founders are simultaneously the most valuable people to reach and among the hardest to find. They rarely appear in corporate databases, often use personal email domains, and their companies may be too new for data providers to index.

Why founders are different: At companies under 50 employees, founders often use personal Gmail or custom domain emails (sarah@sarahchen.com) rather than company domains. Their companies may not appear in ZoomInfo or Apollo because the databases have not indexed them yet. And founders get so many cold emails that many actively scrub their addresses from public directories.

5-step process to find a founder's email

Step 1: Check their personal website and social bios. Many founders maintain a personal website or blog with a contact page. Check their Twitter/X bio, LinkedIn about section, and any link-in-bio tools (Linktree, Bento, etc.). Founders who are raising capital or building in public often make their email findable intentionally.

Step 2: Search AngelList and Crunchbase. Both platforms list founder profiles with contact information. Crunchbase Pro includes verified emails for many startup founders. AngelList (now Wellfound) profiles sometimes include a direct email, especially for founders who are actively hiring.

Step 3: Check the company's about page and early press. When a startup launches, the founder often appears in TechCrunch, Product Hunt, or industry press with a contact email in the article. Search "founder name" "company name" email or "founder name" "company name" contact.

Step 4: Look at podcast and conference appearances. Founders who are building their company's brand frequently appear on podcasts and at conferences. Show notes and speaker bios almost always include an email. Search "founder name" podcast or "founder name" speaker.

Step 5: Run waterfall enrichment. If steps 1-4 fail, use Cleanlist's waterfall enrichment with the founder's LinkedIn URL. Even for early-stage founders, the 15-provider waterfall finds verified emails 80%+ of the time by cross-referencing multiple databases that may have captured the address before the founder started protecting it.

How to Find a CFO's Email

CFOs are among the hardest B2B contacts to reach. They receive fewer marketing emails than CMOs or VPs of Sales, so their addresses are less commonly scraped — but they are also less publicly visible, making them harder to find.

Why CFOs are different: Unlike VPs of Marketing who publish content or founders who build in public, CFOs operate behind the scenes. They rarely speak at marketing conferences, almost never write blog posts, and their public appearances are limited to financial filings, earnings calls, and investor presentations.

Where to find CFO emails

SEC filings and investor documents (public companies). For publicly traded companies, CFO names and sometimes direct contact information appear in 10-K filings, proxy statements, and earnings call transcripts. Search the SEC's EDGAR database at sec.gov/cgi-bin/browse-edgar for company filings. The CFO's name always appears. Their direct email sometimes does.

Press releases about financial results. Companies publish quarterly earnings press releases through PR Newswire and Business Wire. These releases include a "media contact" or "investor relations contact" that often provides the CFO's assistant's email or a direct finance department address that reveals the email pattern.

Financial conferences and investor days. CFOs attend finance-specific events: JP Morgan Healthcare Conference, Goldman Sachs Communacopia, industry-specific investor days. Speaker pages and attendee lists from these events include contact information.

LinkedIn search with filters. Search LinkedIn for the company name plus "CFO" or "Chief Financial Officer" or "VP Finance." At companies under 200 employees, the finance leader may have a different title — "Head of Finance," "Director of Finance," or "Controller."

Waterfall enrichment with title targeting. Use Cleanlist to search by company domain and target the "CFO" or "Chief Financial Officer" title. The waterfall queries 15+ databases, including financial data sources that specialize in executive-level contacts. This is the most reliable method for CFOs at private companies where no public filings exist.

Success rate: CFO emails are found at roughly 75% rate through waterfall enrichment, compared to 40-50% through manual methods. The gap is larger for private companies.

How to Find a VP of Marketing's Email

VPs of Marketing are the easiest executive-level contacts to find. They are professionally incentivized to be visible — their job is building brand awareness, which means they publish content, speak at events, host webinars, and maintain active social media presences.

Why VPs of Marketing are easier: Marketing leaders produce the content that other methods rely on to find people. They write blog posts with author bios. They speak at events with published speaker pages. They host webinars with registration confirmation emails. They run LinkedIn profiles optimized for discoverability. Their email is often the one used in "contact the author" links on company blogs.

Best methods for VP of Marketing emails

Check the company blog. If the company publishes content, the VP of Marketing or CMO often has an author profile with an email address. Even if the email is not listed, the author profile reveals the name and title — enough to construct a pattern-based email.

Search for conference appearances. Marketing leaders speak at events like SaaStr, Inbound, Content Marketing World, and industry-specific conferences. Search "VP Marketing" "company name" speaker or "CMO" "company name" conference.

Check webinar registrations. Marketing leaders host webinars. The registration and follow-up emails come from a real address. If you have attended a webinar hosted by the target company, check your inbox for the sender's email.

Search podcast guest lists. Marketing leaders appear on marketing podcasts frequently. Search "name" "company" podcast and check show notes for contact information.

LinkedIn enrichment. VPs of Marketing maintain highly complete LinkedIn profiles (it is part of their job). Enriching their LinkedIn profile through Cleanlist's waterfall has a 90%+ success rate for this role.

Success rate: ~90% via enrichment tools. The highest of any C-suite or VP-level role because marketing leaders are the most publicly visible executives.

Email Finder Tool Comparison

Not all email finder tools work the same way. Some search a single database. Some use pattern detection. A few use multi-provider waterfall enrichment. Here is how the most popular tools compare across the features that actually matter.

Key differences to understand:

• Waterfall enrichment is the single biggest differentiator. Tools that query one database max out at 80-85% accuracy. Cleanlist's 15-provider waterfall reaches 98% because each provider fills the others' gaps. See the full Cleanlist vs Hunter comparison.
• Phone numbers matter if you run multi-channel outreach. Hunter, Snov.io, Clearbit, and FindThatLead do not include phone data — you need a separate tool. Cleanlist, Apollo, RocketReach, and Lusha include direct dials.
• Free tiers vary significantly. Cleanlist offers 30 free credits. Apollo offers 100 credits per month but with lower accuracy. Hunter offers 25 free searches per month. Clearbit has no free tier.
• CRM integration is table stakes at this point. Most tools connect to Salesforce and HubSpot. Cleanlist also integrates with Pipedrive.

For a deeper comparison, see our reviews of Cleanlist vs Apollo and Cleanlist vs RocketReach.

Which Email Finder Tool Should You Use?

The right tool depends on your volume, budget, and what data you need beyond email addresses.

How to Verify Found Emails Before Sending

Finding an email address is half the job. Verifying it is the other half — and the half that protects your sender reputation.

Why verification matters: Email service providers like Google and Microsoft track your domain's bounce rate. If your bounce rate exceeds 2%, your deliverability drops. Exceed 5% and you start landing in spam. Exceed 10% and recovering that domain can take months. Every unverified email you send is a gamble with your domain's reputation.

What email verification checks

1. Syntax validation — Is the email format correct? (e.g., no spaces, valid characters)
2. Domain verification — Does the domain exist? Does it have valid MX records?
3. SMTP mailbox check — Does the specific mailbox exist on the mail server?
4. Catch-all detection — Does the domain accept all emails regardless of the mailbox? (These are risky — the email "validates" but may not actually reach a person.)
5. Disposable email detection — Is it a temporary email from services like Guerrilla Mail or Mailinator?
6. Role-based detection — Is it a generic address (info@, support@, sales@) rather than a personal address?

Verification workflow

1. Collect your found emails from any of the seven methods above
2. Upload to a verification tool — Cleanlist's email verifier runs all six checks through its 15-provider waterfall
3. Remove invalid addresses — Hard bounces, non-existent domains, syntax errors
4. Flag risky addresses — Catch-all emails, recently changed MX records
5. Send only to verified addresses — Target under 1% bounce rate for maximum deliverability

For a complete guide to verification best practices, see how to verify email addresses and our email verification glossary page.

Frequently Asked Questions

Is it legal to find someone's email address?

Yes, finding a publicly available business email address is legal in most jurisdictions. However, what you do with that email is regulated. In the US, CAN-SPAM requires you to include an unsubscribe option and your physical business address in commercial emails. GDPR in Europe requires legitimate interest or consent before emailing, and you must honor opt-out requests. CASL in Canada requires express or implied consent. The safest approach: use found emails for genuine one-to-one business outreach (legal everywhere), not for mass marketing without consent.

What is the best free email finder tool?

For free usage, Hunter.io offers 25 searches per month for email pattern detection and domain search. Cleanlist offers 30 free credits that include full waterfall enrichment and verification — higher accuracy per lookup. Google advanced search operators are completely free with no limits, but require manual effort and only work for publicly listed emails. For most people, starting with Cleanlist's 30 free credits gives you the highest-quality results with zero cost.

How do you find someone's email from LinkedIn?

Copy the person's LinkedIn profile URL and paste it into an enrichment tool like Cleanlist. The tool matches the LinkedIn profile to contact records across 15+ data providers and returns a verified email address. This method works for approximately 85% of LinkedIn profiles. For a detailed walkthrough, read our guide to enriching LinkedIn leads. LinkedIn itself does not display email addresses publicly unless the user has enabled that setting in their privacy preferences.

What is waterfall enrichment for email finding?

Waterfall enrichment is an approach where a contact lookup queries multiple data providers in sequence rather than relying on a single database. If Provider A does not have the email, the query automatically moves to Provider B, then C, through 15 or more providers. Each email found is verified against the actual mail server before being returned. The result: 94% email discovery rate versus 50-60% from any single provider. Cleanlist built its entire platform around this approach — see how waterfall enrichment works.

How accurate are email finder tools?

Accuracy varies dramatically. Single-source tools like Hunter and Snov.io deliver 75-85% accuracy on the emails they return. The issue is coverage — they only find emails for 50-60% of contacts, so your effective accuracy across an entire list is 40-51%. Multi-provider waterfall tools like Cleanlist achieve 98% accuracy on returned emails with 94% coverage, for an effective accuracy of 86-92% across your full list. Always verify any email before sending, regardless of which tool you used to find it.

Can you find personal emails for B2B outreach?

You can sometimes find personal emails (Gmail, Yahoo, Outlook) through social media mining and Google search. However, we strongly recommend against using personal emails for B2B outreach. Sending unsolicited business email to a personal address is a GDPR violation in Europe, damages your brand perception, and triggers higher spam complaints than business-domain emails. If you can only find a personal email, use it to identify the person and then use waterfall enrichment to find their work email. Business-domain emails convert at 2-3x the rate of personal-domain emails for cold outreach anyway.

Related Deep Dives

• How to Find Work Email: 5 Methods — Shorter guide focused specifically on work email discovery
• How to Enrich LinkedIn Leads Safely — Step-by-step LinkedIn enrichment walkthrough
• Best Email Verification Tools — Full comparison of verification platforms
• Best Sales Prospecting Tools — Complete stack for outbound sales
• How to Build a B2B Lead List — End-to-end list building guide
• What Is Waterfall Enrichment? — Deep dive into multi-provider data aggregation