How to Find Anyone's Work Email Address (and Prove It Before You Send)
You have a name and a company. You need the address. There are three honest ways to get it: find where it leaks, guess it from the company's pattern, or pay someone who has already done both at scale. This is how each works, in the order I use them, with the numbers that decide how many guesses are worth making.
Start with the pattern, because companies only use one
Almost every company issues addresses in one format for everyone. Find one confirmed address at Acme and you know the format for all of Acme. Without one, you guess — and the guesses are not equal. Across large samples of company domains, first.last is used by a plurality, then first alone, then first-initial-plus-last. The top three together cover roughly two thirds of companies; the top five cover about three quarters.
Those percentages are base rates, not a prediction about the company in front of you. They tell you where to look first. The permutator lays out all twenty forms for a name, ranked by this table, with the domain's mail setup checked so you are not guessing against a dead domain. The bulk version does it for fifty names across fifty domains and exports the lot.
Where the real address leaks
Before guessing, spend two minutes looking. PDFs on the company site — white papers, press kits, investor decks — carry author metadata and contact lines. Press releases end with a media contact in the company's format. Conference speaker pages and podcast show notes list addresses. GitHub commits carry them. A "contact" or "team" page with one mailto: link gives you the pattern even if it is the wrong person. Paste any of that into the extractor and it pulls every address out, deduplicated and classified.
Verify without sending
A guessed address that does not exist is a hard bounce, and a list of guesses bounces at whatever rate the pattern is wrong — typically 20–60%, against the 2% that Gmail and Microsoft start punishing at. So no guess goes into a sequence unverified. Verification opens an SMTP conversation with the domain's mail server, says RCPT TO: with the address, and reads the answer: 250 means the mailbox exists, 550 means it does not. No message is sent. The verifier does this for one address; the bulk permutator runs a sample of up to fifty from the page.
The catch-all problem
A catch-all domain accepts every RCPT TO, real or not. Ask it whether priya.raman@ exists and it says yes; ask about zzzz@ and it also says yes. Verification cannot confirm anything there. Roughly a fifth of company domains behave this way, and a lot of them are Google Workspace tenants with catch-all routing switched on. On a catch-all domain the ranked guess is all you have from the outside, and you send to it in small numbers, watch the bounce rate, and stop the moment it climbs. Or you use data that was confirmed another way — a reply, a signature, a vendor's activity data — which is the reason lead-data services exist.
The free-mail case is simpler: do not guess. Patterns are a corporate convention. On Gmail or Outlook.com people took whatever was available in 2011, and a bounce there goes straight into the largest reputation systems on the internet. Find the work domain instead.
When to stop guessing and buy
For one prospect, the pattern-plus-verify loop takes three minutes and works about four times in five. For a list of two hundred companies it is a day's work with a 20% hole where the catch-alls are. That is the point at which I hand it to my data team at Rooster4am, who start from the company and role, find the address in the sources that carry it, and verify it against the mail server before it goes on the list. One address per person, no cap, and the catch-alls are resolved from evidence rather than probability.
Sources
Tools for this
Email permutatorEvery plausible address for a name, ranked.Bulk email permutator50 names × 50 domains × 20 patterns, to CSV.Email extractorEvery address out of any text, deduped.Email verifierFree email verification — is this address real and safe to send to?Frequently asked questions
What is the most common email format?
first.last@company — used by roughly 35–40% of companies. Then first@ at about 15% and flast@ (first initial plus surname) at about 12%. The top three cover around two thirds of companies.
Can I verify an address without emailing it?
Yes. An SMTP verification asks the mail server whether the mailbox exists during the RCPT TO step and disconnects before sending anything. The recipient never sees it.
What is a catch-all domain?
A domain whose mail server accepts every address, real or not, so a verification check cannot tell you whether a specific mailbox exists. About one company domain in five behaves this way.
Is guessing email addresses legal?
Generating an address is not regulated; sending to it is. Business-to-business cold email is lawful in most jurisdictions with honest sender identity and an easy opt-out. Bouncing guesses is a deliverability problem, not a legal one.
How many guesses should I verify per person?
Three to five. Beyond the top five patterns the odds per guess fall under 4%, and each verification costs time or credits. If none of the top five exists and the domain is not catch-all, the person probably uses a different domain.