How to Find Anyone's Work Email (5 Methods That Actually Work)

Why finding the email is the real bottleneck

You know who you want to reach. You've found them on LinkedIn. You've even drafted a great cold email. But then you hit the wall: you don't have their email address.

This is where most people give up. They send a LinkedIn connection request instead (which gets ignored 90% of the time) or they fall back to applying through the company website. The entire outreach strategy dies at the inbox door.

The good news? Finding someone's work email is not nearly as hard as it seems. Most companies use a predictable email format, and once you know the pattern, you can figure out almost anyone's address. Here are five methods that actually work, ranked from easiest to most creative.

Method 1: The email format + educated guess

This is the simplest approach and works more often than you'd expect. Most companies use one of a handful of email formats:

first@company.com — common at startups (e.g., sarah@stripe.com)
first.last@company.com — the most common format overall (e.g., sarah.chen@company.com)
firstlast@company.com — no separator (e.g., sarahchen@company.com)
first_last@company.com — underscore variant
flast@company.com — first initial + last name (e.g., schen@company.com)

To figure out which format a company uses, Google something like "@company.com" email or site:company.com "contact" email. Press releases, team pages, GitHub commits, and conference speaker bios often reveal at least one email address from the company. Once you have one, you know the pattern for everyone.

Method 2: Google dorking

Google is absurdly powerful for finding email addresses if you know the right search operators. Here are some queries that surface results fast:

"@company.com" "person's name" — searches for their email appearing anywhere on the web
site:github.com "@company.com" — finds email addresses in public GitHub commits and profiles
site:twitter.com "@company.com" — sometimes people share their work email on social media
"person's name" company email filetype:pdf — finds resumes, conference presentations, and whitepapers where email addresses are often listed

This method takes a few minutes per person, but it's free and surprisingly effective. GitHub is an especially good source for engineers and technical roles — every public commit contains the author's email address.

Method 3: Check their public profiles

Before going full detective mode, check the obvious places. People leave their email addresses in more public spots than you'd think:

Personal website or portfolio — many people list a contact email, especially in creative and technical fields
GitHub profile — the profile page often has an email field, and their commit history definitely does
Twitter / X bio — some people include their email or link to a contact page
LinkedIn "Contact info" section — if you're connected (or they've made it public), the email is right there
Conference talk pages — speaker profiles on event websites frequently include email
Published papers or blog posts — academic and technical authors almost always list a contact email

This takes 2-3 minutes and has a higher success rate than people realize. Start here before trying anything more complex.

Method 4: Email verification tools

Once you've made an educated guess at someone's email using Method 1, you can verify whether it's real without actually sending anything. Several tools can check if a specific email address exists on a mail server:

Email verification services — tools like NeverBounce, ZeroBounce, or Verifalia will tell you if an email address is valid, invalid, or risky. Most offer a few free verifications.
Google's autocomplete — start composing an email in Gmail and type their name. If you've ever been in a thread with them (or they're in your organization's directory), Gmail will suggest the address.
Catch-all detection — some companies use catch-all servers that accept any email to their domain. In that case, any reasonable guess will land, though it might not reach the right inbox.

The combination of guessing the format (Method 1) and verifying (Method 4) is the most reliable free approach. You'll get it right about 70-80% of the time.

Method 5: Ask someone who works there

This sounds too simple, but it works incredibly well. If you have even one connection at a company — a former classmate, a friend of a friend, someone you met at a meetup — just ask them:

"Hey, I'm trying to reach [person] about a [role] opportunity. Do you happen to know their email, or could you point me to the right person?"

People are generally happy to help, especially if you're polite and specific about why you're reaching out. You get the email and a potential warm introduction, which is even better than a cold email.

Even if your connection doesn't know the specific person, they can confirm the email format ("yeah, we all use first.last@") which makes Method 1 a guaranteed hit.

What about email finder tools?

There are dozens of paid tools — Hunter, Apollo, Lusha, RocketReach — that claim to find anyone's email. They can work, but there are some things to know:

Accuracy varies wildly. These tools scrape data from around the web. Some of it is outdated. Some is straight-up wrong. Always verify before sending.
They're expensive at scale. Most charge per lookup or require a monthly subscription. If you're doing targeted outreach (5-10 companies), the free methods above work just fine.
Privacy concerns. Some of these databases are built from scraped data of questionable legality. Be thoughtful about the tools you use and how the data was collected.

For job search outreach, you usually don't need a massive database. You need 3-5 accurate emails per company. The manual methods are often faster and more reliable for that volume.

Putting it all together

Here's the workflow that gets the best results in the least time:

Step 1: Find the person on LinkedIn. Get their full name and confirm their current company.
Step 2: Check their public profiles (GitHub, personal site, Twitter) for a listed email. Takes 2 minutes.
Step 3: If no email is listed, Google the company's email format. Make an educated guess.
Step 4: Verify your guess with an email verification tool.
Step 5: Send a short, personalized cold email.

For a single contact, this process takes about 10-15 minutes. For five contacts at the same company, it takes maybe 20 minutes total since they all share the same email format.

Or skip the research entirely

The process above works, but it adds up. If you're reaching out to 10 companies, that's 2-3 hours of research before you write a single email. Multiply that by a few weeks of job searching and you've spent days just finding email addresses.

That's why we built dm-the-boss. You enter a company name and the role you're interested in. It researches the company, identifies the right people to contact based on company size and your target role, figures out their email addresses, writes personalized emails for each contact, and sends them straight from your Gmail.

The research that takes 15 minutes per contact happens in about 60 seconds. You review the contacts and emails before anything goes out — nothing gets sent without your approval.

The bottom line

Finding work emails isn't a mystery. It's a repeatable process: identify the person, figure out the company's email format, make a guess, and verify. The five methods above will cover 90% of cases.

The real question isn't whether you can find someone's email. It's whether you're willing to spend the time doing it manually for every single contact, or whether you'd rather automate the boring parts and spend your energy on what actually matters: writing emails that get replies.