How to find someone's business email

You know exactly who you want to reach — you can see their LinkedIn profile right now — but there's no email on it. Here are the five ways that actually work in 2026, from free to automated, plus the one step people skip that quietly destroys their deliverability.

1. Guess the pattern (free, surprisingly effective)

Most companies use one format for everyone: [email protected], [email protected], or [email protected]. Find one known address anywhere — a press release, a support reply, GitHub commits — and you know the pattern for the whole company. No known address? Generate the three most common permutations and verify (step 5) before sending.

2. Check where emails hide in public

• Company site: about, team, press, and legal pages; PDF whitepapers (author metadata).
• GitHub: commit author emails are public on many profiles — gold for reaching developers.
• Podcasts, conference bios, personal sites — people share contact info where they promote themselves.

3. Enrichment tools

Hunter, Apollo, RocketReach and similar keep databases mapping people to verified work emails. Typical accuracy is good for established companies, weaker for startups and recent job-changers. Costs run per-lookup or per-seat and add up fast at list scale — fine for one-off lookups, expensive as infrastructure. (If you're building full lists, read how to find B2B leads without buying a list first.)

4. The LinkedIn export trick (and its limits)

Your own first-degree connections can export with emails — useful for warm lists, useless for cold prospects. Third-party scrapers that promise emails for anyone violate LinkedIn's terms and their data is stale more often than sellers admit. Treat any scraped address as unverified until proven otherwise.

5. Let an agent do the whole loop

If you're finding emails one at a time, the methods above are enough. If you're doing outbound at any scale, the lookup is the smallest part of the job — you also need the list itself, verification, personalized drafts, pacing, and follow-up. persist runs that entire loop: describe who you're trying to reach, and the agent finds the people, resolves verified emails from its directory, and handles everything after.

The step that isn't optional: verify before you send

Every method above produces some wrong addresses, and wrong addresses bounce. Past a ~5% bounce rate, mail providers start treating everything you send as suspect — one bad list can follow your domain for months.

Run every address through SMTP verification before it gets an email (persist does this automatically; standalone verifiers work too). And keep your sending volume inside provider limits — here's the real math on daily caps, and the full deliverability checklist if you're setting up from scratch.