Blog
How to find someone's email address
Eleven methods, each with the case where it fails — and the step every listicle leaves out, which is finding out whether the address you derived is real.
VerifyInbox · published 11 September 2026 · 7 min read
Most of what follows produces a candidate, not a confirmed address. That distinction is the whole point of this page. A pattern applied to a name is a hypothesis; an address scraped off a conference programme in 2019 is a hypothesis; a plausible guess that looks exactly like the eleven other addresses at that company is still a hypothesis. Only the receiving mail server can settle it, and the last section is about asking it.
The methods are ordered roughly by how often they work for business addresses, and each one says where it breaks. None of this covers personal consumer addresses. Finding someone’s private Gmail is a different activity with different ethics, and it is not what any of these methods are for.
1. Search operators
The fastest thing to try, and it costs nothing. Put the domain and the name in quotes together, and search for the address shape rather than the person.
"@company.com" "Jane Doe"
site:company.com "@company.com"
site:company.com "jane.doe"
"jane.doe" "company.com" -site:linkedin.com
"jane" "@company.com" filetype:pdfThe filetype:pdf variant is the one people forget. Press kits, annual reports, conference programmes and academic papers carry contact addresses in the body text, and they are indexed.
Where it fails: companies that deliberately publish no addresses, and search engines that have stopped honouring the operators. Results also skew old — an address in a 2019 PDF tells you the format that company used in 2019.
2. The company's own pages
Contact data lives on a handful of predictable pages, which is why a targeted crawl beats an exhaustive one. Check /team, /about, /contact, /press, /leadership — and, on a German site, /impressum.
Where it fails: addresses obfuscated as images, behind a contact form, or written as jane [at] company [dot] com. The last one is recoverable — that is one of the four extraction methods a crawler needs — but not by eye at scale.
3. Press releases and media pages
A press release almost always carries a real, monitored contact address, because the entire purpose of the document is to be replied to. Newswire archives keep them long after the company has redesigned its site.
Where it fails: the address is usually a role account — press@ or an agency mailbox — rather than the person you want. It is still useful: it reveals the domain’s address format if it is a personal address, and it reaches a human either way.
4. Conference speaker pages and academic profiles
Speakers submit a bio and a contact address, and programme committees publish them. University staff directories publish them as a matter of policy. Both are indexed, both are long-lived, and an academic address is often the most stable thing about a person’s online presence.
Where it fails: the address is frequently the one they used at a previous institution or employer. Check the year on the page before trusting it.
5. WHOIS
Still occasionally works, and it is worth thirty seconds on a small company’s own domain. whois company.com from a terminal, or any web WHOIS client.
Where it fails: almost everywhere now. Registrar privacy services replaced the registrant contact with a proxy address as a default, and for domains covered by GDPR the registration data is redacted outright. Treat a real address in WHOIS as a pleasant surprise rather than a method.
6. The GitHub patch trick
Every git commit records an author email. GitHub will hand you the raw patch for any public commit, and the patch header contains it.
https://github.com/<owner>/<repo>/commit/<sha>.patchWhere it fails: GitHub has offered a users.noreply.github.com address by default for years, and most accounts now use it, so the patch header gives you [email protected] and nothing else. It also only ever works for people who commit publicly, which is a small and specific population.
7. Git log on a repository you already have
The same principle without the round trip. If you have cloned the repository, the addresses are already on your disk.
git log --format='%aN <%aE>' | sort | uniq -c | sort -rn | head -20Where it fails: the same noreply addresses, plus stale ones. A contributor who left in 2021 committed under an address that stopped accepting mail in 2021.
8. Personal sites and link-in-bio pages
People who want to be contacted say so. A personal site, a link-in-bio page, a newsletter footer, an "about" page on a blog — these are addresses published deliberately, which makes them both the most likely to work and the least ambiguous ethically.
Where it fails: it is usually a personal address, not a work one, which may be the wrong channel for what you are writing about.
9. Your own address book and existing connections
Boring and frequently correct. Search your mail archive — you may already have the address, or an address at that domain that reveals the format. Most professional networks let you export the contact details of people you are already connected to.
10. Derive it from the company's address format
This is the method that scales, and it is the one most likely to be quietly wrong. Most organisations use exactly one template — {first}.{last} is the commonest — so one known address plus a name often gives you another.
Find the format from any address you already have at the domain, or look it up: the email pattern finder infers it from published addresses and shows you the ones it used, and there are pages for fifty well-known company domains already.
Where it fails, and it fails in a specific way: executives and long-tenured staff often predate a format change and keep the old one. Duplicate surnames force exceptions. Acquired teams keep their old domain for years. And a pattern inferred from a single sample is a coincidence with a confidence score attached — which is why a tool that reports its sample count is worth more than one that reports a percentage.
11. Use an email finder
What a finder does that the manual route does not is run the three steps in order and tell you which one produced the answer: check whether the address is already published (with the page it came from), apply the domain’s inferred pattern if it is not, and verify the result against the mail server before returning it.
The part worth insisting on is the disclosure. "Found on this page, last confirmed on this date" and "generated from a pattern with three agreeing samples, verified" are different claims, and a tool that returns both as a single address with a green tick has thrown away the only information that tells you how much to trust it.
Where it fails: small domains nobody has crawled, people who have never had an address published anywhere, and companies whose format has exceptions. A finder that returns nothing is being honest; ours does not charge for that.
You have a candidate. Now find out whether it is real.
This is the section the ranking listicles do not have, and it is the one that decides whether any of the previous eleven were worth doing.
An email address can be wrong in three independent ways, and only the third one matters to you:
| Layer | Question | Who can answer it |
|---|---|---|
| Syntax | Is this a well-formed address? | Any library, offline, instantly |
| Domain | Can this domain receive mail at all? | A DNS lookup |
| Mailbox | Does this mailbox exist? | Only the receiving mail server |
Verification asks the third question by opening an SMTP conversation with the domain’s mail server, naming the address, reading the reply, and stopping before any message is transmitted. Nothing arrives in anyone’s inbox and nothing is logged against the recipient — the conversation ends before the part where a message would be sent.
There are three possible answers, and the third is the one to understand. deliverable: the server confirmed the mailbox. undeliverable: the server said it does not exist. unknown: the question was not answered — the probe was blocked, DNS failed, the server deferred, or the domain accepts every address. An unknown is not a soft no. Treating it as one is how a real person gets deleted from a list.
Run the candidate through the free email verifier before you write to it. Three checks a day per IP with no account; a free account is 100 credits a month, renewing.
A note on what is reasonable
Business contact data that a company publishes on its own website is generally processable in most jurisdictions, subject to conditions that vary by where you and the recipient are. That is the honest summary and it is not legal advice; take your own for your jurisdiction.
What we will commit to on our own behalf: our crawler respects robots.txt, identifies itself, and is described at /bot. A request through /data-request erases matching records immediately and keeps them out of every later crawl, rather than merely marking them hidden.
And the practical version: an address you found is an address, not a relationship. The response rate on a message that could only have been written to that person is not comparable to the response rate on one that could have been written to anybody.
Terms used on this page
More: How to validate an email address in Python · Email validation regex: the pattern and its limits · Gmail, Yahoo and Microsoft sender requirements · How to block disposable email addresses