The CEO reads email. Not LinkedIn InMail, not the contact form that goes to marketing, not the info@ inbox an intern checks on Fridays. Email. Which is why a verified CEO address is the single most valuable data point in B2B outreach, and why finding one takes more than typing a name into Google. This guide covers the 8 methods that actually produce a deliverable address in 2026, fastest first.
1. Run a free email finder
The fastest path: enter the CEO's name and company domain into an email finder. Good finders generate the common corporate patterns and test each against the company's live mail server, returning the one that exists. Getlead's free email finder does exactly this, checking 8 patterns with a real SMTP handshake, 5 searches a day free.
2. Guess the pattern, then verify
CEO addresses are predictable. Companies under 200 people overwhelmingly use first@company.com for founders and executives; larger companies standardize on first.last@company.com. Write out the candidates:
- john@acme.com
- john.smith@acme.com
- jsmith@acme.com
- john.s@acme.com
Then confirm which mailbox exists with the free email verifier. Never skip verification: a bounce on a cold send hurts your domain reputation, and executives at catch-all domains will silently swallow wrong guesses.
3. Search a B2B contact database
Databases skip the guessing entirely. Getlead's 420M+ B2B database lets you filter by title (CEO, founder, owner), industry, company size and location, then exports addresses that are SMTP-verified at export time. This is the only method that scales past one-off lookups: a list of 500 verified CEO addresses in a niche takes minutes, not weeks.
4. Check the company website
Smaller companies publish more than you'd expect. Scan the about page, team page, press page and legal/imprint page (mandatory in the EU and often signed by the managing director). PDF annual reports and press releases frequently contain direct executive contacts. An email extractor pulls every address from a page in one pass so you don't hunt by eye.
5. Mine LinkedIn (the right way)
LinkedIn itself rarely shows emails, but it gives you the two inputs every other method needs: the exact name spelling and the current company. Some executives also list contact info on their profile's contact section, and posts announcing funding or hiring often end with a direct address. Read our guide on scraping LinkedIn leads for the scaled version of this workflow.
6. Use CEO email directories, carefully
Sites like ceoemail.com list contact addresses for CEOs of large public companies, mostly for consumer complaints. Two caveats: many entries actually route to executive assistants or PR teams, and directory data decays fast as executives move. Treat a directory address as a lead, not a fact, and verify it before sending.
7. US public companies: SEC filings and IR pages
For CEO email addresses at US public companies, proxy statements (DEF 14A), 8-K filings and investor relations pages regularly contain executive contact details or at minimum the exact naming format the company uses. Combine the format with pattern verification from method 2 and you have the address.
8. Ask the gatekeeper
Old-fashioned but effective: email a lower-friction address at the company (sales, support, a team member from the website) with a short, honest note asking who handles the topic and how to reach them. Reply rates on polite routing requests are far higher than most people expect, and the forwarded introduction beats any cold open.
Whatever you do: verify before you send
Executive inboxes sit behind the strictest filters at the company. A single bounce or spam-trap hit from a guessed address lowers deliverability for every future email from your domain. The rule: no address goes into a campaign until it has passed a live SMTP check. Getlead runs that check automatically on every export, or use the free verifier for one-offs.