The CEO reads email. Not LinkedIn InMail, not the contact form that goes to marketing, not the info@ inbox an intern checks on Fridays. Email. Which is why a verified CEO address is the single most valuable data point in B2B outreach, and why finding one takes more than typing a name into Google. This guide covers the 8 methods that actually produce a deliverable address in 2026, fastest first.
1. Run a free email finder
The fastest path: enter the CEO's name and company domain into an email finder. Good finders generate the common corporate patterns and test each against the company's live mail server, returning the one that exists. Getlead's free email finder does exactly this, checking 8 patterns with a real SMTP handshake, 5 searches a day free.
2. Guess the pattern, then verify
CEO addresses are predictable. Companies under 200 people overwhelmingly use first@company.com for founders and executives; larger companies standardize on first.last@company.com. Write out the candidates:
- john@acme.com
- john.smith@acme.com
- jsmith@acme.com
- john.s@acme.com
Then confirm which mailbox exists with the free email verifier. Never skip verification: a bounce on a cold send hurts your domain reputation, and executives at catch-all domains will silently swallow wrong guesses.
3. Search a B2B contact database
Databases skip the guessing entirely. Getlead's 420M+ B2B database lets you filter by title (CEO, founder, owner), industry, company size and location, then exports addresses that are SMTP-verified at export time. This is the only method that scales past one-off lookups: a list of 500 verified CEO addresses in a niche takes minutes, not weeks.
4. Check the company website
Smaller companies publish more than you'd expect. Scan the about page, team page, press page and legal/imprint page (mandatory in the EU and often signed by the managing director). PDF annual reports and press releases frequently contain direct executive contacts. An email extractor pulls every address from a page in one pass so you don't hunt by eye.
5. Mine LinkedIn (the right way)
LinkedIn itself rarely shows emails, but it gives you the two inputs every other method needs: the exact name spelling and the current company. Some executives also list contact info on their profile's contact section, and posts announcing funding or hiring often end with a direct address. Read our guide on scraping LinkedIn leads for the scaled version of this workflow.
6. Use CEO email directories, carefully
Sites like ceoemail.com list contact addresses for CEOs of large public companies, mostly for consumer complaints. Two caveats: many entries actually route to executive assistants or PR teams, and directory data decays fast as executives move. Treat a directory address as a lead, not a fact, and verify it before sending.
7. US public companies: SEC filings and IR pages
For CEO email addresses at US public companies, proxy statements (DEF 14A), 8-K filings and investor relations pages regularly contain executive contact details or at minimum the exact naming format the company uses. Combine the format with pattern verification from method 2 and you have the address.
8. Ask the gatekeeper
Old-fashioned but effective: email a lower-friction address at the company (sales, support, a team member from the website) with a short, honest note asking who handles the topic and how to reach them. Reply rates on polite routing requests are far higher than most people expect, and the forwarded introduction beats any cold open.
Which method to use, by company size
The eight methods are not interchangeable; company size decides which one pays off. Use this as the routing table:
- Under 50 employees: the CEO is usually the founder and usually first@company.com. Pattern guessing plus verification (methods 1-2) resolves most of these in under a minute, and the website or EU imprint page (method 4) covers the rest.
- 50-500 employees: naming has standardized, typically to first.last@. An email finder or database lookup (methods 1 and 3) beats guessing here, with LinkedIn (method 5) supplying the exact name spelling for hyphenated or transliterated names where patterns go wrong.
- 500-5,000 employees: the database (method 3) is the reliable path, but ask whether the CEO is even the right door. At this size a VP or director owns your topic and answers cold email far more often; the CEO address works best as the forwarding trick described below.
- Public companies and enterprises: SEC filings and IR pages (method 7) give you the naming format, directories (method 6) give you a starting address, and an assistant almost certainly screens everything. Plan for the gatekeeper, not around them.
When the CEO hides behind an assistant or alias
Past a few hundred employees, the address you found often is not the inbox the CEO reads. Some route ceo@ to communications; many delegate the real inbox to an executive assistant who triages everything. This is not a dead end, it changes the play:
- Email the assistant deliberately. Find the EA on LinkedIn (search the company for "executive assistant" or "chief of staff"), find their address with the same pattern methods, and write to them honestly: who you are, why the topic belongs to their executive, and what a 15-minute answer looks like. EAs forward well-targeted requests; their job is routing, not blocking.
- Use the forward-down effect. A reasonable email that reaches the CEO rarely gets a CEO reply; it gets forwarded to the right VP with a one-line "worth a look?". That forward converts far better than emailing the VP cold, so a screened CEO inbox still has value even when the CEO never answers.
- Spot the alias trap. If a directory address looks like press@, office@ or media@, it is a routing alias. Send there only what a comms team would forward, or skip it and work the pattern methods for the personal address.
Whatever you do: verify before you send
Executive inboxes sit behind the strictest filters at the company. A single bounce or spam-trap hit from a guessed address lowers deliverability for every future email from your domain. The rule: no address goes into a campaign until it has passed a live SMTP check. Getlead runs that check automatically on every export, or use the free verifier for one-offs.
The full pre-send workflow takes three passes. First, syntax and MX: does the domain exist and accept mail at all. Second, the SMTP handshake: does this specific mailbox exist. Third, the catch-all decision: some domains accept every address, so the handshake returns "maybe" instead of "yes", and those addresses belong in a low-volume, watch-the-bounces tier rather than your main campaign. The scale of the problem is bigger than most people assume: across 383,368 real verifications we analyzed, 40.7% of addresses were invalid or catch-all before cleaning, and verified-only sending held bounces to 0.51%.
The legal fine print when emailing executives
A CEO address is a business address, which keeps direct outreach legal in most jurisdictions, but the details matter more at the executive level because complaints get acted on faster. Under US CAN-SPAM: truthful subject line, your real identity, a physical postal address in the footer and an opt-out honored promptly. Under GDPR, a named executive is still a natural person: legitimate interest covers relevant B2B outreach, but you should be able to say where the address came from, and a deletion request means delete, not suppress-and-keep. One practical rule covers both regimes: write only about topics the CEO's role makes them responsible for, and make stopping effortless.