Finding someone's email address for cold outreach means finding the work address of a specific decision-maker at a business, not a personal account. The method is almost always the same handful of steps in order: check the obvious public source first, guess from a known pattern only if nothing is published, then verify before anything gets sent.
This page covers that order of methods, a table of the common work email formats, how to verify a guess without sending to it, and what not to do. It builds on our sales prospecting guide, which covers finding the right person as one step in a six-step process; this page goes deeper on the finding and formatting part specifically.
How do you find someone's work email address for cold email?
Start with the business's own website, then LinkedIn, and only fall back to pattern guessing when neither publishes an address. Each method is faster to rule out than the last one, so working through them in order saves time over starting with a guess.
- Check the company website first. A contact page, team page, or staff directory often lists a direct address or at least confirms the name and title of the person you want.
- Check LinkedIn. Confirms the person's current title and company, and sometimes shows a contact or "about" section with an address. Even without one, it confirms you have the right person before you spend time guessing.
- Check press pages and public filings. A press release, a conference speaker bio, or a company's own blog post sometimes includes a direct address or at least a consistent name format to work from.
- Guess from the company's known email pattern, built from any address you already have at that company or from the pattern table below, only once the first three steps turn up nothing.
- Verify the guess before sending anything to it. A guessed address is a hypothesis, not a fact, until it passes a check.
What are the common work email formats for cold email?
Most companies pick one address pattern and use it for every employee, so once you know a company's pattern and a person's name, their address is usually one of a short list of options. The table below shows the patterns themselves, not statistics on how often each one is used; treat it as a checklist to try in order, not a set of odds.
| Pattern | Example (Jane Doe at example.com) | Where it tends to show up |
|---|---|---|
| first@ | jane@example.com | Very small businesses, often where the owner set up the first mailbox |
| first.last@ | jane.doe@example.com | Common at larger and more formal organizations |
| firstlast@ | janedoe@example.com | A no-separator variant of first.last@ |
| flast@ | jdoe@example.com | Common at mid-size companies |
| first_last@ | jane_doe@example.com | An underscore variant, less common than the dot version |
| lastf@ | doej@example.com | Occasional, seen at some larger organizations |
If you already know one real address at a company, whether from a signature, a press mention, or a prior reply, use that exact pattern for everyone else there rather than guessing fresh for each person. A business that settled on flast@ for one employee almost always uses it for the rest.
A free email permutator builds every common pattern from a name and a domain in one go, so you are not typing out each variant by hand before you verify them.
Can WHOIS records help you find a work email for cold email?
A WHOIS lookup can sometimes return a registrant email address for a domain, but most registrars now mask that field, so WHOIS is a low-probability check worth trying only after the higher-yield sources. Treat it as a fallback, not a first step.
- Run a WHOIS lookup on the company's domain. A free registrar or registry lookup tool returns whatever is publicly listed.
- Check whether the registrant contact is masked. Many registrars replace the real address with a privacy-proxy address by default, which is not usable for outreach.
- If an unmasked address appears, confirm it is current. Domain registration details can be years out of date, so verify the address the same way you would any other guess.
Press pages and public filings, covered above, tend to return a usable name or address far more often than WHOIS does, so work through those first.
How do you verify a guessed address before a cold email goes out?
Verify with an SMTP-level check, which asks the receiving mail server whether an address would be accepted without actually sending a message. This confirms or rules out a guess in seconds, and it keeps a wrong guess from ever counting as a bounce against your sending domain.
Our free email verifier checks one address at a time: type a guess in, and it comes back valid, invalid, catch-all, a shared inbox, or disposable in plain terms. The right workflow pairs the two tools: build the candidate list with the email permutator, then verify each one before you write to any of them.
Never send to several guessed variants to see which one bounces. Every bounce counts against your sending domain's reputation, and a cold email program that burns through guesses this way can damage a domain before it ever gets a real reply. Our bounce rate guide covers what that damage actually costs.
What happens to cold email when the domain is catch-all?
A catch-all domain accepts mail to any address, real or not, so a verification check cannot confirm which specific guess is correct. Every pattern you try will come back accepted, which looks like good news and is not.
On a catch-all domain, a verification tool should return the result as catch-all rather than a false valid. At that point, confirm the person's name and role through LinkedIn or the company site rather than trusting the first accept response. Send any guess in a small batch rather than a full campaign push. Our catch-all email guide covers the decision in full, including when it is still reasonable to send.
What should you not do when finding an email address for cold email?
Do not scrape personal accounts, do not use a harvested list, and do not treat a shared business inbox as a failure to find the right contact. All three cause real problems that are easy to avoid.
- Do not scrape personal email addresses. Cold email is for reaching a business decision-maker at their work address, not finding someone's personal Gmail or similar account through unrelated means.
- Do not use address-harvesting software or buy a harvested list. Several countries treat this as a separate legal violation on top of whatever consent rule applies to the email itself. Our cold email legality guide covers the country-by-country rules, including where harvesting is explicitly banned.
- Do not assume a shared inbox means you failed. Role addresses like info@ or sales@ are often the only contact a small business publishes, and the owner reads them directly.
Is it fine to send cold email to info@ or another shared inbox?
Yes, for small businesses a shared inbox like info@ or sales@ is usually read by the owner or a small team, and sending there is a normal part of reaching a business that has no named contact published. The one adjustment is the opener: address the business by name, not a person, since there is no name to greet.
Shared inboxes are not the same as automated addresses like noreply@ or postmaster@, which nothing reads and which should never be emailed. Our cold email list quality guide covers the full set of address types, including which role addresses are worth sending to and which are not.
How do email finder tools fit into cold email prospecting?
An email finder tool automates the same steps covered above. It checks known patterns for a domain, searches public sources for a published address, and runs a verification check, then returns a ranked guess rather than you doing each step by hand. This page intentionally does not rank or recommend a specific vendor; the category exists, and the steps it automates are the ones listed above.
Whichever tool or manual method you use, the result is still a guess until it passes verification. No category of tool removes that last step.
Which method should you try first when finding a cold email address?
Work through the methods in the order they cost the least time for the result they give, rather than jumping straight to a tool.
| Method | Typical cost in time | When it works best |
|---|---|---|
| Company website | Low | Small businesses that publish a contact or team page |
| Low | Confirming the person's title and current company | |
| Press pages and filings | Medium | Larger or more public companies with a press presence |
| Pattern guessing plus verification | Medium | Any company once you know or can guess its format |
| WHOIS | Low, but low yield | A last resort once the above turn up nothing |
| Email finder tool | Low effort, but still needs a verification step | Running the same process at higher volume |
Finding a work email address for cold email FAQ
How do you find someone's email address for cold email when nothing is published?
Build a candidate list from the company's known email pattern, using any address you already have there as the template, then verify each candidate with an SMTP-level check before sending to any of them. Our email permutator and email verifier cover both steps for free.
What is the most common work email format for cold email?
There is no single format used everywhere; it varies by company and often by company size, with very small businesses leaning toward a first-name-only address and larger organizations leaning toward first.last@ or a first-initial-plus-last-name pattern. Treat the pattern table on this page as a checklist of what to try, not a fixed rule.
Is it legal to find and email someone's work address for cold outreach?
Finding a published work address and emailing it is generally legal for business-to-business cold email in the US, with other countries attaching consent requirements depending on whether the contact is a company or an individual. Our cold email legality guide covers the country-by-country breakdown, including what turns a legal email into an illegal one.
How do I find a work email address by name for free for cold email?
Check the company website and LinkedIn first, since both are free and often enough on their own. If neither publishes an address, use a free email permutator to build the likely patterns for that domain, then a free email verifier to confirm which one is real.
Should I guess an email address and send a cold email to it directly?
No. Verify any guessed address with an SMTP-level check first. Sending an unverified guess risks a bounce, and every bounce counts against your sending domain's reputation regardless of whether the guess turns out to be right.