You have researched the right company, you know who you want to reach, but the email address is missing. This is exactly where sales teams lose time every day, because addresses are hidden, outdated or simply not published anywhere. Yet with the right methods, most business email addresses can be found within minutes. In this article I will show you six ways to find email addresses, how to verify them before sending anything and what the legal side looks like.

‍

Key takeaways

In the EU, the fastest route is often the legal notice page, because e-commerce law requires business websites to publish an email address.
Most companies use a handful of standard formats such as firstname.lastname@company.com. Once you know a company's pattern, you can derive missing addresses reliably.
Email finder tools work with databases, pattern tests and SMTP checks. For individual contacts, free monthly quotas are usually enough.
Verify every address before you hit send. A bounce rate above 2 percent damages your deliverability.
Researching publicly available business addresses can be done in line with data protection law. For promotional emails, the EU ePrivacy rules and national laws like Germany's Section 7 UWG set the limits.

‍

Why the right email address matters so much

The quality of the address decides the success of your outreach before you have written a single word. Backlinko analyzed 12 million outreach emails and found a reply rate of just 8.5 percent. If you send your message to info@, it lands in a shared inbox between newsletters and job applications and has practically no share of that rate. If you reach the right recipient directly, you play in a different league.

There is a second problem that many underestimate. Contact data ages quickly, because people change jobs, departments get renamed and companies merge. According to HubSpot, email databases lose around 22.5 percent of their validity every year. An address list from last year is already close to a quarter dead weight.

In my experience, researching the right address is better invested time than the tenth rewrite of your subject line. A mediocre email to the right recipient beats the perfect email to a shared mailbox.

Six methods to find business email addresses

Which method is right depends on whether you are looking for a single address or contact data for a whole target group. Here is the overview, then we go through each method in detail.

‍

Method	Best for	Effort	Cost
Legal notice & website	Individual companies in the EU	Low	Free
Deriving email patterns	Individual contacts	Low	Free
Search engine operators	Publicly listed addresses	Medium	Free
LinkedIn & business networks	Existing connections	Medium	Free
Email finder tools	Individual research at volume	Low	Free quotas, then paid
AI-powered lead research	Complete lead lists	Very low	Credit-based

‍

Method 1: Legal notice and company website

In the EU you have an advantage that hardly exists in any other market. The E-Commerce Directive requires providers of commercial websites to publish details that allow quick electronic contact, explicitly including an email address. In Germany this is the famous Impressum, and most European countries have an equivalent legal notice page. A compliant company website must therefore state a reachable email address.

Often you will only find a general address like info@ or contact@ there. But with that you already know the domain and often the company's format too. Also check team, press and career pages, because personal addresses appear there regularly. PDF files such as brochures, price lists or job postings often contain direct contact details of employees as well.

Method 2: Deriving and testing email patterns

Almost all companies assign addresses according to a fixed scheme. If you know a single real address from the company, you can transfer the pattern to your contact. The most common formats are

firstname.lastname@company.com
f.lastname@company.com
lastname@company.com
firstname@company.com
firstnamelastname@company.com

With the following generator you can create all common variants for your contact in one go.

‍

Email pattern generator

Enter first name, last name and company domain, and all common format variants are generated automatically.

The second step matters. Verify the variants with a verification tool before you send anything.

‍

From the community

In an r/sales thread on address research, several salespeople describe exactly this workflow as their standard. They identify the format through a known address or a format lookup service, rebuild the target address and check it with a verification tool. One user adds a trick that is often faster: call the switchboard and simply ask for the usual email format.

‍

The second step is what counts. A derived address is a guess, not yet a hit. Do not send anything before you have verified it, otherwise you risk bounces. I will show you how further below.

Method 3: Using search engines properly

Many business addresses are already public, just not on the homepage. With search operators you can find them precisely. Proven queries include

"First name Last name" + "email"
site:company.com "firstname.lastname"
"First name Last name" + "@company.com"

Here is a detail many people miss. Google interprets the @ sign as a hint for social media profiles, while DuckDuckGo searches literally. The query "@company.com" returns all publicly indexed addresses of the domain there. Presentation slides, attendee lists and academic publications are also productive sources, because they almost always contain direct contact details.

Method 4: LinkedIn and business networks

On LinkedIn, some users list their email address publicly in the contact info section. For first-degree connections you can usually see these details in full. So before researching, check whether you are already connected or share a mutual contact.

Do not rely on it alone though, because most profiles show no address. LinkedIn works best as a source for names, positions and job-change signals, and you then complete the actual address via patterns or tools. Depending on your market, local business directories can be worth a look as well.

Method 5: Email finder tools

If you search for addresses regularly, specialized tools take the manual work off your hands. They operate on three principles you should know, because they determine hit quality. Database tools look up existing contact collections, which inevitably age. Permutation tools generate format variants and check them live via SMTP queries to the mail server. Waterfall tools combine several data sources in sequence until a verified hit comes back.

For getting started, the free quotas of the well-known providers are usually enough. You can find a detailed comparison in our guide to the best email scrapers.

‍

From the community

Under the most popular YouTube tutorials on email search, one frustration keeps repeating in the comments. The tools do find addresses, but only once you already have the contact's name. That groundwork stays with you. Our guide on finding the right contact person shows how to identify the right person in a company.

‍

Method 6: AI-powered lead research instead of one-by-one search

All previous methods share the same limit. They work per contact and turn into grunt work at 50 or 200 target companies. For this case there are tools like Leadscraper, where you describe in free-text fields who you are looking for. Hundreds of AI agents then research live on the web and deliver a lead list with company name, website, the right contact person, phone number and a verified email address in one step. Every contact comes with a source reference, because only publicly available data is used. The difference to a classic database is that every list is freshly researched, so the decay problem never arises in the first place.

‍

Tip

Combine the methods instead of relying on one. Legal notice and patterns cost nothing and solve individual cases, tools speed up the routine. As soon as you need lists regularly, switching to automated research pays off quickly.

‍

Verify found addresses before you write to them

Before a single email goes out, every found address belongs in verification. The standard for this is the SMTP check. The verification tool connects to the domain's mail server and simulates a delivery without sending an email. If the server responds positively, the mailbox exists.

In practice you need no technical knowledge for this. Services like NeverBounce or the EU provider Bouncer check individual addresses right in the browser. You paste the address, wait a few seconds and get back a status like "valid", "invalid" or "catch-all". For entire lists you upload a CSV file and receive it back with a verdict per address. Costs are in the cent range per address and many providers offer a free quota to get started. If you work with automatically generated lead lists, verification is usually already built in.

Catch-all addresses play a special role. Some companies configure their mail server to accept every address of the domain, including invented ones. Verification tools flag such addresses as "unknown" or "risky", because the mailbox's existence cannot be confirmed technically. Write to such contacts sparingly and only in small batches.

Why the effort? Every invalid address produces a bounce and bounces damage your sender reputation. A bounce rate below 2 percent is considered healthy. Above that, you increasingly land in the spam folder, even with correct addresses. Our guide on the email sender score explains how to build and protect your sender reputation.

‍

From the community

In an r/b2bmarketing thread, a user gives an urgent warning against running high sending volumes on unverified lists. In his experience, even with a clean technical setup you ruin your domain faster than you can build a replacement.

‍

The legal side: what is allowed when finding email addresses?

Legally you have to separate two levels, the finding and the outreach.

Researching publicly available business contact data is workable under data protection law. Legitimate interest under Art. 6(1)(f) GDPR comes into consideration as the legal basis and the GDPR's recitals explicitly name direct marketing as a possible legitimate interest. Information duties come with it. At the latest on first contact you must disclose where you got the data. You can find details in our guide on GDPR-compliant lead generation.

The outreach is the real hurdle. Under the EU ePrivacy rules, promotional email generally requires prior consent, and national laws implement this strictly. Germany's Section 7 UWG, for example, treats email advertising without express consent as unacceptable harassment and that applies in B2B too. The widespread assumption that you can freely advertise to business customers is simply wrong for email in most EU markets. Anyone doing cold email outreach is on thin ice legally and risks warning letters, even though it happens constantly in day-to-day sales. Legally safer in B2B are the phone, where implied consent can suffice depending on the country, or postal mail, which remains largely permitted.

One more point that is often misunderstood. The fact that an address must appear in a legal notice does not make it fair game. The publication duty serves reachability, it does not replace consent to advertising. This section is, by the way, a practical assessment and not legal advice, when in doubt the topic belongs with a lawyer.

From a single contact to a complete lead list

Individual research hits its limits as soon as you want to build new business systematically. From this point on you need a repeatable process. In practice this sequence has proven itself.

Define your target group precisely, the more specific the better
Identify matching companies
Determine the right contact person per company
Find and verify the email address
Enrich contacts with context, such as trigger and talking point

For step 5, a look at lead enrichment is worthwhile, because an address without context remains a cold contact.

The classic route via purchased address lists only appears to solve the problem. Static databases age from the day they are created, and the 22.5 percent decay per year mentioned above hits purchased lists just the same. In sales communities like r/sales, reports are piling up that the data quality of large contact databases is noticeably declining. Freshly researched data beats aging inventories almost every time. That is exactly what Leadscraper builds on with its live research, and if you want to hand off the whole process, you can now even have the outreach handled up to the first contact, so that only the actual conversations land in your calendar.

Common mistakes when finding email addresses

‍

Writing to unverified addresses

Every guessed address without verification is a potential bounce. From a bounce rate of 2 percent, the deliverability of your entire domain suffers.

Collecting only generic inboxes

Lists full of info@ and contact@ addresses look like progress but barely convert. What counts is the direct line to the decision maker.

Researching private addresses

Private Gmail and similar addresses have no place in B2B research. Data protection law applies a stricter standard to them and reputable tools deliberately exclude them.

Buying once, using forever

If you keep using a list for years, you increasingly write into the void. Contact data is perishable goods and belongs in regular checks or fresh research.

‍

Conclusion: finding email addresses is a process, not a gamble

Finding email addresses works reliably if you go about it methodically. For individual contacts, the legal notice, format patterns and search operators get you there for free, tools speed up the routine and at real volume, AI-powered lead research takes over the whole chain from company selection to the verified address. Two rules always apply. Verify every address before sending, so your bounce rate stays below 2 percent. And do not treat the legal side as a footnote, because between legally finding an address and using it for promotion lie the EU ePrivacy rules and laws like Section 7 UWG. If you respect both, the tedious address hunt becomes a plannable building block of your customer acquisition.

Frequently asked questions about finding email addresses

How can I find an email address for free?

The three best free routes are the company's legal notice or website, derived format patterns such as firstname.lastname@company.com and search engine operators such as "name" + "@company.com" on DuckDuckGo. In addition, most email finder tools offer free monthly quotas for individual lookups.

How accurate are email finder tools?

Hit rates vary considerably by tool, industry and region. Database-based tools are often weaker for smaller European companies than for international tech firms, because their data inventories are thinner there. Tools with live SMTP verification deliver the most reliable results. A hit marked as "verified" is close to certain, a "catch-all" hit remains a guess.

Can I find out a person's private email address?

For private addresses there is no reputable research route and usually no legal basis either. The GDPR sets tight limits on processing private contact data and reputable finder tools deliberately restrict themselves to business addresses. For B2B outreach you do not need them anyway, because you want to reach the person in their professional role.

What is a catch-all address?

With a catch-all configuration, a domain's mail server accepts every email, regardless of whether the mailbox exists. Verification tools therefore cannot confirm such addresses and flag them as "unknown" or "risky". Whether the address really works only shows at sending time.

How to Find Email Addresses: Methods, Tools and the Legal Side in B2B

Generate B2B Leads with AI?

Why the right email address matters so much

Six methods to find business email addresses

Method 1: Legal notice and company website