How to find someone's work email from their name and company.
You know who you want to reach and where they work, but not their email address. Here are the manual methods that work, the email patterns companies use, why guessed addresses bounce, how catch-all domains confuse verification, and when it's worth using a finder instead.
On this pageWhat you need first
To find a work email you need two things: the person's full name and their company's email domain. The domain is usually the company website without the www., so www.acme.com gives you acme.com.
Watch out for companies whose email domain differs from their website. A product might live at getacme.io while the team's email is @acme.com, or a company might have rebranded and kept its old mail domain. If you find any real employee address (next step), trust its domain over the website.
Throughout this guide we'll use one example: Jane Doe, Head of Marketing at Acme, website acme.com.
1. Check the company website
Start where the company itself publishes addresses. Small companies often list people directly. Larger ones at least reveal their format.
- Team, About and Leadership pages. Sometimes each person has a mail link.
- Contact page. Look for named contacts for sales, partnerships or press.
- Press or Newsroom. Press releases often end with a “Media contact” that includes a real person's email, which shows you the pattern.
- Blog author pages. Some sites link an author's email.
- Legal pages, imprint and privacy policy. In some countries the imprint (Impressum) names a managing director and an address.
Addresses are often hidden from bots as jane [at] acme [dot] com or jane(at)acme.com. Read them as normal addresses.
QuickExtract's free company email finder does this step automatically for any website: it checks the homepage and up to 8 likely pages (contact, about, team, company, support, help, impressum, privacy and similar), decodes the [at] and [dot] tricks, and ranks addresses that match a person's name, such as jane.doe@ or jdoe@, above shared ones.
2. Work out the email pattern
Most companies give every employee an address in the same format. Once you know the format, you can apply it to any name. Here are the common ones for Jane Doe at acme.com:
| Pattern | Example |
|---|---|
| first.last | [email protected] |
| first | [email protected] |
| firstinitial + last | [email protected] |
| first + last | [email protected] |
| firstinitial.last | [email protected] |
| first + lastinitial | [email protected] |
| first_last | [email protected] |
| last.first | [email protected] |
| last + firstinitial | [email protected] |
How to confirm which one Acme uses
Find any one real employee address at the domain, from a press release, a blog post, a job ad or a support page. If the head of sales is [email protected], Jane is very likely [email protected]. Small startups often use first name only, because there's only one Jane.
Names that need extra care
- Accents: José Núñez is usually
jose.nunez@. - Double or hyphenated surnames: Ana García-López might be
ana.garcia@,ana.garcialopez@orana.garcia-lopez@. - Nicknames: Robert may go by Rob or Bob in his address.
- Common names: a second John Smith may get
john.smith2@or a middle initial.
Each of these is a reason a pattern-based guess can be wrong even when the pattern itself is right.
3. Search with Google operators
Search operators let you look for the address, or the pattern, across the whole web. Copy these and swap in your own name and domain:
"[email protected]"tests a specific guess. Any hit means it has been published somewhere."jane doe" "@acme.com"finds pages that mention her and an Acme address."@acme.com" -site:acme.comfinds Acme addresses published on other sites, which shows you the pattern.site:acme.com "@acme.com"finds every page on Acme's own site that shows an address.site:acme.com filetype:pdf "@acme.com"searches PDFs such as brochures and reports, which often include contact details."jane doe" acme email, the plain version, sometimes surfaces an interview or speaker bio.
4. Other public places to check
- Conference and webinar pages, where speaker bios sometimes include contact details.
- Podcast show notes and guest posts.
- Public code repositories, for technical people who commit with their work address.
- Product Hunt maker profiles and personal websites, for founders. See finding Product Hunt founder emails.
- The company's social profiles, which sometimes list a named contact.
If none of these turn up her address, you're left with the pattern guess, and that's where the risk starts.
Why guessed emails bounce
A guess built from the right pattern is still just a guess. It bounces when:
- the company uses a different pattern from the one you picked, or uses several;
- the person uses a nickname, a middle initial or a numbered address;
- the person has left the company and the mailbox was closed;
- the email domain is different from the website domain;
- there's a simple typo in the name or domain.
A bounce on one email isn't a disaster. Many bounces from the same sending domain are. Mailbox providers treat a high bounce rate as a sign of a poorly kept list, which can push your future emails toward spam. That's why sending a batch of guesses to “see what sticks” is a bad idea, especially from a new domain. See how to warm up a cold email domain.
Catch-all domains
Some mail servers are set to accept mail for any address at the domain, real or not. On a catch-all domain, jane.doe@, jdoe@ and xyz123@ all look accepted when checked. The message may then be bounced later, delivered to a shared inbox, or quietly dropped.
That breaks the usual way of checking a guess. A standard mailbox check sees “accepted” for every variant, so most verifiers can only label catch-all addresses as “unknown” or “risky”. You either skip them or send and hope. Catch-all emails explained goes deeper.
Verify before sending
Before you send to any address you didn't see published, verify it. A thorough verification has three passes:
- Format and domain: the address is well formed, and the domain exists and is set up to receive mail.
- Mailbox: the mail server confirms the exact mailbox exists.
- Catch-all: for domains that accept everything, a separate check to separate real addresses from guesses.
You can try a mailbox check by hand over SMTP, but many servers block or rate-limit these checks, and it does nothing for catch-all domains. A verification service is the practical route.
Using an email finder instead
The manual process works for one or two people. For a list of fifty, it's an afternoon of searching and still ends in unverified guesses. An email finder does the pattern work and the verification together.
QuickExtract's email finder finds the work email of leads that have a name and a company website, such as leads from a Sales Navigator scrape or Product Hunt makers. Select the people you want to reach, and it looks for each person's address at their company's domain.
| What happens | Cost |
|---|---|
| Valid person email found and verified three times | 1 credit |
| No valid email found | No charge |
| Catch-all check | Included |
| Company emails and publicly listed emails | Always free |
| Credit packs | From $29 for 2,000 (1.45¢ each) to $499 for 100,000 (0.5¢ each) |
An email that fails any of the three passes is dropped and not charged. If you've already built a list of guesses by hand, you can run it through the email verifier with the same credits. There's no subscription, and you don't need a card to start.
However you find an address, write to people for a clear business reason, follow anti-spam and data protection laws where they live, and make it easy to opt out. This is general information, not legal advice.
Email finding questions.
What's the most reliable way to find a work email?
An address the person or company published themselves. After that, the company's pattern confirmed from a real employee address, followed by verification. A guess you haven't verified is the least reliable option.
Can I send to every pattern variant and see which one works?
It's a bad idea. Most variants will bounce, and repeated bounces damage your sending domain's reputation. Verify first, then send to one address.
Why does my verifier say “unknown” for some addresses?
Usually because the domain is catch-all: it accepts every address, so a standard mailbox check can't tell. QuickExtract runs a dedicated catch-all check on these domains.
Do I pay if QuickExtract can't find an email?
No. A credit is used only when a valid, verified email is found. Credits cost $29 for 2,000.
Skip the guessing.
$29 for 2,000 verified work emails. Three-pass verification included, and you pay only when a valid email is found.