How to Find Anyone's Professional Email (2026)
Finding a contact's professional email from their name and company is straightforward if you go in the right order. The key is not to guess randomly, but to reconstruct the company's email format and then verify the address you get. Here is the complete method, from free tools to automation.
5 steps to find a professional email
1. Identify the company domain
Everything starts from the domain used for email. It almost always matches the company website (company.com), sometimes a variant (company.co, mail.company.com). Confirm the domain actually used for mail by looking at a public company address (contact@, an email signature, a legal notice).
2. Determine the company's email format
Most companies apply a single pattern to all their addresses: first.last@, f.last@, firstlast@, etc. This format is inferred from actually observed addresses: the larger the sample, the more reliable the estimate. An email-format tool gives you a domain's dominant pattern in seconds.
3. Generate the possible permutations
If the format is unknown, generate every plausible combination from the first name, last name and domain: first.last, last.first, f.last, first@, etc. An email permutator produces this list automatically. Never use it as-is: each candidate still has to be tested.
4. Verify each candidate address
Verification checks that an address exists without sending an email: syntax, domain existence, MX record, then an SMTP dialogue with the server. It classifies the address as valid, invalid or uncertain (the catch-all case). Keep only valid addresses — sending to unverified permutations hurts your deliverability.
5. Automate with waterfall enrichment
For a single contact, free tools are enough. For a list, waterfall enrichment queries several sources until it finds and verifies an address, row by row. This is what reaches high coverage rates without manual work, while guaranteeing that every delivered email is reachable.
Methods to avoid
Buying unverified email databases, sending to role-based addresses (contact@, info@) hoping to reach a decision-maker, or sending to untested permutations: these shortcuts hurt your sender reputation and therefore all your following campaigns. One rule only: never use an address that has not been verified.
Free tools and resources
Frequently asked questions
Can you find someone's email for free?
Yes, for a single contact: identify the domain, infer the format with a free tool, generate the permutations and verify them. To process an entire list automatically, an enrichment service is more efficient.
Is an inferred address reliable?
Not until it is verified: an address built from a format is still a hypothesis. SMTP verification confirms it actually exists before any send.
What if the domain is catch-all?
On a catch-all domain the server accepts every address, so SMTP verification cannot confirm a specific mailbox. You then have to combine other signals (the address appearing in sources, consistency with the observed format).
Is it legal to look up a professional email?
In B2B, contacting a professional about a topic tied to their role can fall under legitimate interest under GDPR, provided the outreach stays relevant and offers an easy way to object.