How to Find Anyone's Email Address in 2026 (7 Methods)

Finding a real, deliverable email address is the first hurdle in any outreach campaign. Guess wrong and your message bounces, your domain reputation drops, and future emails land in spam for everyone on your list, not just the person you guessed at.

This guide covers seven methods that still work in 2026, ordered roughly from fastest to most reliable, plus the verification step that matters more than any of them.

Why this is harder than it looks

Email addresses are not published anywhere central. There is no directory. What exists instead is a patchwork: corporate mail servers that will confirm whether an address exists, public documents that happen to contain addresses, and commercial data providers that have assembled their own records over time.

Two things make that patchwork unreliable. First, people change jobs. MarketingSherpa research, cited by HubSpot, puts B2B data decay at 2.1 percent per month, an annualised rate of 22.5 percent, and Dun and Bradstreet has put it higher still, at around 30 percent a year. Either way, something like a quarter of any stored contact list is wrong within twelve months of being collected. Second, many companies now run catch-all mail servers that accept mail to any address at the domain, which defeats the usual way of checking whether a specific address is real.

Both problems are solvable. Neither is solved by finding an address and hitting send.

1. Start with their LinkedIn profile

A person's LinkedIn URL is the single strongest starting point, and it is worth understanding why.

An email lookup has to resolve three things: the right human, their current employer, and that employer's mail domain. A name alone gives you none of them reliably. "James Chen, VP Sales" matches hundreds of people. A LinkedIn profile URL is unique, states the current employer, and is maintained by the person themselves, which makes it fresher than any scraped database.

So the practical order of operations is: find the profile first, then resolve the email from it. Not the other way around.

2. Infer the company pattern, then verify it

Most companies use one predictable format across the whole organisation:

Find one known address at the company, from a press release, a support thread, an email signature, or a public commit, and you have the pattern for everyone else. Apply it to your target, then verify the result before you send. An inferred address is a hypothesis, not a contact.

This method is free and works well at companies with more than a handful of staff. It tends to fail at organisations that mix formats, which is common after acquisitions.

3. Use waterfall enrichment

Waterfall enrichment queries several data providers in sequence and returns the first verified hit, rather than relying on any single source.

This matters because coverage is the binding constraint, and the numbers are stark. Published benchmarks put a single provider's match rate somewhere between 35 and 60 percent on a typical B2B list, with the strongest individual tools reaching the low-to-mid 80s. Stacking several providers in a waterfall typically pushes that past 80 percent, and one 2026 three-tool benchmark reached roughly 94 percent coverage.

The gaps are not random either: providers differ in strength by region, company size, and industry, which is precisely why stacking them works. Querying one and giving up is how you end up with a list where a third or more of the rows are blank. It costs more per lookup. It also produces lists you can actually send to.

4. Search company pages and public documents

Slower, free, and still effective, particularly for senior people:

• Team and about pages. Smaller companies often list addresses directly.
• Conference speaker bios and programme PDFs. Frequently carry a direct contact.
• Press releases. The media contact is usually a real, monitored address, and it reveals the company pattern.
• Public code repositories. Developers often commit under a work address, which git log exposes.
• Regulatory filings. Public company filings list officer contacts.
• Personal sites and newsletters. Many senior people publish an address they actually read.

5. Use search operators

Search engines will surface addresses that are published but not prominent. Useful patterns:

• site:company.com "@company.com"
• "firstname lastname" "@company.com"
• site:company.com filetype:pdf "@company.com"
• "firstname lastname" email OR contact -linkedin

This works best for people who have spoken publicly, published research, or been quoted in the press.

6. Verify before you trust anything

This is the step people skip, and it is the one that decides whether the campaign works.

Verification means checking that an address will accept mail before you send to it. A verification service connects to the receiving mail server and asks, without delivering anything, whether the mailbox exists. Results fall into four buckets:

Catch-all domains deserve their own note. A catch-all server says yes to every address, so verification cannot separate a real mailbox from a typo. Sending to one is a gamble: the address may route to a real person, into a void, or to a spam trap. A reasonable policy is to send to catch-all addresses only where you have corroborating evidence the person holds that role, and to keep them a small share of any given send.

7. Ask, when the stakes justify it

For a small number of genuinely high-value targets, the highest-yield method is not technical. A warm introduction through a mutual connection, a reply to something they published, or a short message asking where to send something, all beat any lookup tool on both accuracy and response rate. It does not scale, which is exactly why it works.

The mistake that costs the most

Sending to unverified addresses is worse than not sending at all.

Mailbox providers track the share of your sends that bounce, and the industry benchmark for staying in good standing is to keep bounces under 2 percent. Push past that and you start to look like a sender who buys lists rather than one with a real audience.

Google is more specific about the related metric it publishes. Its sender guidelines require anyone sending more than 5,000 messages a day to Gmail to keep the spam rate reported in Postmaster Tools below 0.30 percent, and recommend staying below 0.10 percent. Since February 2024 those senders must also authenticate with SPF, DKIM, and DMARC, and offer one-click unsubscribe. Yahoo introduced matching requirements at the same time.

The consequence of getting this wrong is not confined to the bad addresses: legitimate mail to good addresses starts landing in spam too, and recovering a damaged sending domain takes weeks.

The rules that follow from this:

• Verify every address before it enters a sequence.
• Remove undeliverable results rather than sending and hoping.
• Warm a new sending domain gradually rather than starting at full volume.
• Authenticate with SPF, DKIM, and DMARC before the first send.
• Use a separate domain for cold outreach so a problem never touches your main corporate mail.

A note on compliance

Finding an address is not the same as being allowed to mail it. In the US, CAN-SPAM requires accurate headers, a real physical postal address, and a working unsubscribe mechanism in commercial mail. In the EU and UK, GDPR requires a lawful basis for processing personal data, with legitimate interest the usual route for B2B outreach, and it gives people the right to object and to be erased. Neither regime bans cold B2B email outright. Both require you to identify yourself honestly and to stop when asked. Build the unsubscribe path in from the start rather than bolting it on later, not least because Gmail now requires one-click unsubscribe from bulk senders regardless.

Putting it together

A workflow that holds up at volume looks like this:

1. Define the audience precisely, by role, seniority, industry, company size, and geography.
2. Resolve people to LinkedIn profiles, so each row is a specific human at a specific employer.
3. Enrich each profile through a waterfall of providers to get an email, and a phone where available.
4. Verify every result, and drop anything undeliverable.
5. Write outreach specific enough to be worth a reply.
6. Send from a warmed, separate domain, paced rather than blasted.

Steps two through four are where most of the time goes, and they are entirely mechanical.

Do it in one step

Laxon runs that pipeline end to end. Describe who you are looking for in plain English, or upload a list you already have, and it finds the people, enriches verified email, phone, and LinkedIn, drops what will not deliver, then writes and sends the outreach while pacing to protect your domain.

If you are working specifically from LinkedIn, the LinkedIn email finder guide goes deeper on that path, and cold email vs LinkedIn outreach covers which channel to use once you have the contact details.

Try Laxon free and build a verified list in a few minutes.