ON THIS PAGE
By Efe Berke Colaker, Founder at GetleadReviewed by the Getlead editorial team for accuracy. Last updated August 2026.
You have a company, a domain and a person's name. What you do not have is the one thing that makes the next step possible. And there are roughly five ways to get it, with wildly different hit rates.
Most guides list them in the order that fills a page. This one lists them in the order that finds the address fastest. That means the cheap high yield methods first and the tedious ones last.
Every method ends at the same place: a candidate address that has to be verified before anyone sends to it.
Method 1: look it up in a database
Start here every time. A B2B contact database has already done the matching work. So a lookup either returns a sourced address in seconds or tells you the record is not held, which is itself useful information.
The difference from every method below is provenance. A database record was linked to a person by some process you can ask about. While everything else on this page produces a guess that happens to survive testing.
When the lookup misses, note what it returned rather than moving straight on. A database that holds the company but not the person tells you the domain is real and active. That raises the odds that pattern inference will work.
Method 2: find one address, get the whole company
Companies use one convention. Find a single confirmed address at the domain and you have solved the format for every employee. That turns a per person problem into a per company one.
- The website contact or team page, where a named address is often published.
- Press releases and media pages, which usually list a real person rather than a shared inbox.
- Job postings, which sometimes include a hiring manager's address.
- Support or documentation pages, where an engineer's address occasionally appears.
- Your own database, if you already hold anyone at that company.
The last one is the fastest and the most overlooked. Most teams already hold a contact at a meaningful share of their target accounts. And that single record answers the format question without any research at all.
Be careful about what you learn from. A shared inbox like info@ tells you nothing about the personal naming convention, because it is not a person. You need a named address to infer a pattern.
A company domain is the shared part of every work address at an organisation. And pairing it with a known naming convention is what turns a name into a testable candidate address.
For example, finding press@example.com published on a media page tells you nothing. But finding daniel.roth@example.com in a press release tells you the convention is first.last, which resolves every other name at that company in one step.
Method 3: infer the pattern
With no known address, generate candidates from the common conventions and test them. Six formats cover the large majority of business domains.
Order the candidates by company size before testing. Under 20 employees try first name alone first, above 200 start with first.last and flast, because a collision would have forced disambiguation years ago.
Never mail the candidates to see which one answers. Twelve guesses for one person means eleven hard bounces, and bounce rates above 2% per campaign put a sending domain in trouble immediately.
Pattern inference is generating candidate addresses from a name and a known convention, which produces hypotheses rather than confirmed contacts.
Method 4: public sources, where the person published it themselves
Some people put their work address in public deliberately, and finding it there is legitimate research rather than inference.
- Conference speaker pages and academic profiles, which often include a contact address.
- Open source commit history, where the work email is attached to contributions.
- Regulatory or company registry filings, depending on jurisdiction.
- Personal sites and portfolios, particularly for founders and consultants.
- Published papers, patents and industry directories.
Two cautions. Addresses published years ago decay like everything else, at roughly 2% a month. So an address from a 2022 conference page needs verifying before it means anything.
And record where you found it. Provenance matters for data quality and, if any of your recipients are in the EU, for the obligation to tell people where their data came from.
The step that makes all of this safe
Every method above produces a candidate. Verification turns a candidate into an address you can send to, and skipping it is what turns research into a deliverability incident.
SMTP verification asks the receiving server whether a mailbox exists and disconnects before delivering anything. Four outcomes are possible, and only one of them means send: confirmed valid, invalid, catch-all and unknown.
Catch-all domains are where the method runs out of road. The server accepts every address, so a pattern guess and a correct address look identical. Put those prospects in a separate segment, send at low volume, and judge them on replies.
A catch-all domain is one configured to accept mail for every possible address, which makes verification results ambiguous by design.
When to stop looking
Effort should be proportional to the account. Three verified attempts is a reasonable ceiling for an ordinary prospect, and a signal to switch approaches rather than to keep generating variants.
The colleague route is underrated. Reaching a named person one desk away and asking for the right contact is often faster than any tool. And it starts a conversation rather than a guess.
Finally, keep the method on the record. A year from now, the difference between a sourced address and an inferred one is invisible unless you wrote it down. And that difference decides whether the record deserves another verification pass or a delete.
Sources and method
First-party data (Getlead, 2026): the verification split of 43.4% confirmed valid, 23.9% invalid, 16.7% catch-all and 16.0% unknown comes from 383,368 addresses analyzed through live SMTP verification. And the 0.51% bounce rate comes from 34,973 tracked sends, aggregated and anonymized at campaign level. Full method in our cold email benchmark study.
External sources: contact decay of about 2.1% a month comes from the HubSpot database decay model built on MarketingSherpa research; the obligation to inform people when their data was obtained from a third party is set out in Article 14 of the GDPR.
US commercial email obligations, including accurate headers, a physical postal address and a working opt-out honored within 10 business days, come from the FTC CAN-SPAM compliance guide.
Figures were checked in August 2026.
Frequently asked questions
How do I find someone's email from a company domain?
In order of hit rate: look the person up in a B2B database, find any one confirmed address at the domain to learn the company's naming convention, infer the pattern for your target, then check public sources. Verify the result with SMTP before sending.
What is the most common company email format?
first.last is the most common overall. Companies under about 20 people often use first name alone because there are no collisions. While larger and older domains lean toward flast or firstl for disambiguation.
Can I find an email with just a domain and no name?
Only role addresses like info@ or sales@, which are shared inboxes rather than people. To reach a named person you need the name, so start by identifying the right individual before trying to find their address.
Is it safe to email a guessed address?
No. Guessed addresses are mostly wrong by construction, and 23.9% of even ordinary raw B2B records are invalid in our verification data. Bounce rates above 2% per campaign damage sender reputation, so verify every candidate before it enters a campaign.
What if the domain is catch-all?
Then no method can confirm the address, because the server accepts mail for everything. Segment those prospects separately, send at low volume from a mailbox you can rest if needed. And judge them on replies rather than on verification status.
How many attempts are worth making for one prospect?
About three verified attempts for an ordinary prospect. Beyond that the odds fall while cost rises. And it is usually faster to reach a confirmable colleague at the same company or to park the record until your database refreshes.