How to Find Someone's Business Email: Methods That Hold Up (2026)

Most advice on how to find someone's business email says the same thing. Install a browser extension. Run an "email finder" on your whole list. Try firstname.lastname@ and hit send. If it bounces, try the next variation. That is exactly how teams burn their sending domains and fill their CRMs with addresses nobody reads.

Finding an address was never the hard part. Tools can produce thousands of them in an hour. The hard part is having the right address, verified, obtained in a way you can explain.

The problem isn't access to data. The problem is that a guessed address with no method behind it costs more than it brings in: bounces, spam complaints and legal exposure.

The rules are also getting sharper. On October 16, 2026, France's data protection authority, the CNIL, published guidance on reconstructing professional email addresses. Its position: guessing a work address can rely on legitimate interest, but that is "neither automatic nor systematic." In the UK, the ICO's business-to-business marketing guidance reminds senders that a named work address is personal data, and that the right to object to direct marketing is absolute. On the technical side, Google asks senders to keep their spam rate below 0.3% in Postmaster Tools, and recommends staying under 0.1%. A sloppy list gets you close to that line fast.

This guide covers the methods that still hold up in 2026, built on two pillars: finding the address through legitimate routes and verifying it before you write a single line.

How do you find someone's business email the right way?

To find someone's business email the right way, start with what they have made public themselves (LinkedIn contact info, company website, talks and press), then work out the company's email format, verify the result, and record where it came from. In B2B, you can then email them without prior consent in most of Europe and the UK, as long as the message relates to their role, you say who you are and they can opt out easily.

Order matters. Go from the most reliable and most expected route to the most inferred one.

The methods, from safest to shakiest

The best email address is the one the prospect gives you. The second best is the one they chose to make visible.

What "legitimate" means in practice

Ask three questions before every search:

• Why them? Is your message about their job? Payroll software for an HR director, yes. For a developer, no.
• Where does the address come from? Could you explain it in one sentence if asked?
• Have they closed the door? A locked-down profile, a hidden address, a contact form instead of an email: those are signals to respect.

This article covers field-tested practice, not legal advice. If you sell into a specific jurisdiction at scale, check the local rules with counsel.

Start with what the prospect made public

Before you guess anything, look at what already exists. It's fast, and it's the most defensible route.

LinkedIn contact info

On LinkedIn, every member decides who can see their email address. According to LinkedIn Help, there are four levels: only visible to the member, 1st-degree connections, 1st and 2nd-degree connections, or anyone on LinkedIn. A separate toggle controls whether connections can download that address in their data export.

The practical takeaway: once you're connected, open the "Contact info" section. Plenty of professionals, especially freelancers, consultants and small-business founders, leave their work email there. They made it visible. They expect to be contacted.

That's also why your connection request matters. A prospect who accepts often opens up their contact details. Our guide to the LinkedIn prospecting message covers how to earn that first reply.

The company website and public footprints

In a small company, the founder's email is often right there: team page, legal notice, press page. Elsewhere, look at:

• Press releases: the media contact, sometimes the CEO.
• Speaking slots: conference agendas, webinar pages, podcast notes.
• Publications: white papers, op-eds, reports with a contact address.
• Other employees' addresses: not to email them, but to spot the company's format.

Weak vs strong: using an address you found publicly

Weak "Hi, I came across your email online and wanted to introduce our solution."

Strong "Hi Karim, I caught your talk at the Austin HR Summit on onboarding new sales reps. Quick question: are you still running onboarding by hand, or is it already tooled up?"

The first message reminds the prospect you went looking for their address. The second reminds them why you're writing.

Working out the email format: the most common method, and the most botched

Inferring the address is the workhorse of B2B outreach. It rests on one simple fact: a company almost always uses the same format for every employee.

The usual formats

For a prospect named Claire Martin at acme.com, the usual candidates are:

The careful version takes three steps:

1. Identify the format from addresses the same company has already published (website, press release, talk).
2. Apply it to your prospect, watching for accents, hyphenated names and prefixes like "van" or "de".
3. Verify the address before anything goes out (next section).

The sloppy version sends the same email to all six variations "just to see." Five bounce. The domain takes the hit. And if the company accepts every address, you never learn which one was real.

What European regulators now say about guessed addresses

The CNIL guidance defines reconstruction as deducing or "guessing" a work address from public information such as first name, last name and employer. It also reminds readers that data being available online doesn't take it outside the GDPR.

To rely on legitimate interest, you need:

• A genuine interest in contacting the person, such as developing your business.
• No disproportionate impact on their rights, assessed case by case: could this person reasonably expect their address to be inferred?
• Consistency with your main processing: if your B2B prospecting rests on legitimate interest, inferring the address can usually rest on the same basis. The CNIL stresses this is "neither automatic nor systematic."

And two concrete safeguards:

• Short retention: keep an inferred address only if real first contact happens within a reasonable time.
• Immediate objection: if the person objects, their data comes out of any further reconstruction, no justification required.

A guessed address isn't an asset. It's a hypothesis: verify it, use it soon, and delete it if it goes nowhere.

When to leave it alone

The CNIL names two situations where a person can't, in principle, expect their address to be reconstructed:

• No identifiable online presence: they may never have wanted to be reached that way.
• Deliberately restricted contact details: tight privacy settings, a contact form instead of an address.

If the conditions aren't met, the guidance is blunt: don't reconstruct the address unless you get the person's consent. In practice, switch channels. LinkedIn, a call, a warm introduction.

Verify before you send, every time

An unverified address isn't an address. It's a bet on your domain's reputation.

The four verification results

Verification tools query the domain's mail server without sending a message. They usually return one of these:

Catch-all is the classic trap. Plenty of companies set their domain to accept any incoming mail. Your guess "passes," but nothing proves it reaches a person. For these contacts, I recommend opening on LinkedIn and holding the email until you have confirmation.

Why bounces are expensive

Mailbox providers judge your domain on the quality of what you send. Google requires every sender to authenticate (SPF or DKIM), offer an easy way to unsubscribe and stay below 0.3% of messages reported as spam. Above 5,000 messages a day to Gmail accounts, DMARC and one-click unsubscribe for marketing messages become mandatory.

A badly verified list stacks both problems: bounces first, then recipients who weren't expecting you and click "spam." Our guide to cold email deliverability covers authentication, warm-up and safe volumes.

Enrichment tools: useful, if you keep the paper trail

Past a few dozen prospects a week, manual research stops scaling. Enrichment tools take over: you give them a name, a company or a LinkedIn URL, and they return an email and often a phone number.

Why a waterfall of providers

No database covers everything. One provider is strong on large European companies, another on US startups, a third on mid-sized manufacturers. Querying several sources in sequence, and stopping as soon as a verified address turns up, increases coverage without paying twice for the same contact.

That's how enrichment works in Reakly: any prospect can be enriched with email and phone through more than 20 providers, straight from the acquisition engine, at the moment they become relevant.

Enrich when it matters, not the whole database

The common mistake: enriching 5,000 contacts at once "just in case." You end up with a database that ages fast and addresses kept with no use, which is exactly what the CNIL asks you to avoid for inferred addresses.

The better rule: enrich a prospect when you have a reason to write to them. A signal (funding round, hiring, new role), engagement with your content, a LinkedIn conversation that's moving. Our article on B2B lead enrichment explains how to keep a clean database without burning budget.

Record the source of every address

Add an "email source" field to your CRM. For example:

• Given by the prospect (conversation, form, event).
• Visible on LinkedIn.
• Public (website, press release), with the URL.
• Inferred and verified, with the date.
• Enrichment, with the provider's name.

That field pays off three ways. You can answer a prospect who asks where you got their address. You can see which sources produce the best reply rates. And you can purge inferred addresses that were never used.

An email address with no known source is a liability. Sooner or later it costs you, in bounces or in explanations.

What privacy law expects once you have the address

Finding the address is only half of it. How you use it matters just as much.

The B2B rules in the UK and EU

The rules differ by country, but the core is similar in the UK and most of the EU. Under the ICO's B2B marketing guidance, emails to corporate subscribers don't need consent under PECR, but a named work address is still personal data under the UK GDPR. Legitimate interests is often the right lawful basis, provided you pass the three-part test. Sole traders and some partnerships are treated as individuals, so the stricter consent rules apply to them.

Generic addresses like info@ or contact@ are treated more lightly in most regimes. They also rarely reach the person you want. Useful for a five-person company, not for reaching a VP of Sales.

An opt-out line that doesn't wreck the tone

A cold email doesn't need a six-line legal footer.

Weak "In accordance with applicable data protection law, you may exercise your right to object by writing to dpo@ourcompany.com."

Strong "If this isn't on your radar, just reply 'no thanks' and I won't email again."

The second one is human, and it works. As long as you actually honor it: a "no thanks" has to pull the contact out of every sequence, right away.

When not to look for the email at all

Sometimes the best way to find someone's business email is not to look for it.

Start on LinkedIn, move to email later

A stranger reads a cold email with suspicion. The same person, after a LinkedIn exchange, reads your email as the next step in a conversation. Coherent multichannel outreach isn't about hitting every channel. It's about using each one at the right moment.

In Reakly, a multichannel campaign can open with a profile visit and a connection request, and only send the email once the address has been found and verified.

Just ask for it

The method everyone forgets. It gives you an exact address and a prospect who's expecting your message.

Weak "Could you send me your email so I can share our brochure?"

Strong "I can send over the scoring sheet I mentioned, with two filled-in examples. Easier here or by email?"

You're not asking for an address. You're offering something useful and letting them pick the channel.

The mistakes that burn your domain and your reputation

The same mistakes show up in almost every team starting outbound:

• Sending without verifying: every bounce drags down your domain's reputation.
• Testing every variation: six sends for one person, five guaranteed bounces.
• Prospecting from your main domain: if its reputation drops, your customer emails suffer too.
• Emailing a personal address (Gmail, personal Outlook) you found somewhere: that's no longer B2B outreach, and it feels intrusive.
• Buying a list when nobody can say where the addresses came from.
• Keeping inferred addresses forever when they were never used.
• Ignoring a "no thanks" because the contact sits in another sequence.
• Skipping the follow-up plan: a verified address is wasted if one unanswered email ends the effort. Our guide to the sales follow-up message shows how to space and vary follow-ups.

Nobody wonders how you found their email when your message lands right. They wonder when they can't see any reason for it.

Conclusion: the right address at the right moment

Finding someone's business email has become easy. Finding it well takes method.

Start with what the prospect made public. Infer the format only when your message is about their role. Verify every address. Record its source. Keep it only if you use it. Honor every objection, immediately.

And when the address is missing or uncertain, go through LinkedIn. An open conversation beats a guessed address.

A pile of addresses fills a CRM. Good addresses fill a calendar.

---

Reakly brings prospect search, signal detection, email and phone enrichment, and LinkedIn + email sequences together in one tool. You enrich a prospect when they become relevant, keep a record of every exchange, and send the email when it actually makes sense. See how Reakly works.