How to Find Someone's Work Email: 4 Methods and How to Verify It

To find someone's work email, start with an address their company has already published. If there is none, apply the company's email format to the person's name and verify the result. Pay for an email finder, or a waterfall of several finders, only when those two steps fail.

The four methods below follow that order. After them: how to read verification labels such as valid and catch-all, and a legal note for EU, UK and US senders. Figures were read on 17 October 2026. Most come from vendors, so each one says who published it.

Method 1: Look for an address the company has published

A business email address is easiest to find when the company or the person put it online. Check team, contact and press pages, the media contact on press releases, speaker bios on event pages, report authors, and the person's own site or newsletter.

Two limits apply:

• Some published addresses are role addresses such as info@ or sales@. They reach a shared queue, not a person. ZeroBounce files role addresses under "do_not_mail" while noting they are valid.
• A published address is not blanket permission to market to it. The ICO says that personal data being in the public domain does not mean the person agrees to direct marketing.

Even when your target's address is not online, one address at the same company shows its format. That is the input to method 2.

Method 2: Use email pattern guessing, then verify

Email pattern guessing assumes that a company formats most staff addresses the same way. The assumption often holds and sometimes does not, so treat every guess as a candidate. In a fictional example, if a press release shows maria.okafor@acme.example, a colleague named Jin Park is probably jin.park@acme.example.

1. Find one confirmed address at the company and note its pattern.
2. Build two or three candidates: the confirmed pattern first, then the usual alternatives (first.last, flast, first, firstlast).
3. Verify each one. Do not test a guess by sending: a wrong guess can bounce, and bounces hurt your sending domain (see the deliverability guide).
4. If the domain is catch-all (see below), a verifier cannot separate a right guess from a wrong one. Use only a pattern confirmed from a real address and treat the result as unconfirmed.

Which email format is most common?

Published statistics disagree, especially for small companies.

Across all sizes, Sendburg's sample of 336,782 work addresses found first.last at 47.7% and flast at 26.8%.

Both sources agree that large companies lean toward first.last and disagree about small ones. Sendburg's figures come from its own contact database and Interseller gives no method, so trust one real address from your target company over either table. A first-name-only format can also collide: sam@ belongs to one Sam, not both.

Method 3: Use an email finder

A finder takes a name and a company domain and returns the most likely address. How it gets there differs by vendor. Hunter's explainer notes that some finders generate the likely pattern, check that the server does not object and return it as valid, while others are more careful.

Hunter's pricing page charges one credit per email found and says a search that finds nothing is free. Its Starter plan lists 2,000 credits for $49 a month on monthly billing ($34 a month on yearly billing; monthly credits do not roll over). If every credit buys one found email, that is about 2.5 cents each on monthly billing. A verification costs half a credit.

Accuracy is where claims diverge. The most detailed public comparison we found comes from a finder vendor, Anymail Finder. It tested 14 tools on the same 5,000 B2B contacts in the US, UK, France and Germany (data collected 19 June 2026) and names itself the best single-source finder. It re-checked every returned email with three independent verifiers and says it was not a live send test. From its table:

• Coverage (contacts that got an email the verifiers judged deliverable) ran from 41.3% to 87.1%, median about 59%.
• The share of contacts that got an email failing verification ran from 0.5% to 23.2%.
• The lowest failure rate (0.5%) came with coverage of only 49.0%. The highest coverage had a 4.0% failure rate.

The label "verified" is not portable. Hunter's verifier treats accept_all as its own status and warns that SMTP checks on such servers can give false positives. ZeroBounce splits "accept-all" from "catch-all" by whether it has vetted the domain's bounce history. Ask which statuses a finder counts as found.

Method 4: Email waterfall enrichment

A waterfall runs several providers in a fixed order on the same contact and stops at the first answer. Hunter's explainer defines it that way. The point is coverage: every provider has gaps, and the next one fills some.

What a waterfall costs

Cost per found email depends on how you are billed:

• Pay per lookup. Price per lookup divided by hit rate. At an illustrative $0.05 per search and a 40% hit rate, that is $0.125 per email found.
• Pay only when found. The price per found email is fixed, and the hit rate decides how much of your list you get, not what each email costs. Hunter and Clay both bill this way.

Compare options on cost per usable contact: total spend, verification included, divided by contacts that end up verified valid.

Order changes the bill, not the coverage

An illustration with made-up numbers. You have 1,000 contacts. Provider A charges $0.03 per found email and can find 450 of them. Provider B charges $0.08 and can find 500, of which 350 are also findable by A.

Same 600 emails. Putting B first pays $0.08 for 350 addresses the cheaper provider would have found. Clay's guide makes the same point with its own example: coverage holds whatever the order, the spend does not.

Vendors disagree on the order. Clay puts the cheapest provider that clears your quality bar first. Hunter's explainer says to start with the strictest finder, even at a higher price, so guessed addresses enter your list only when nothing better exists. They agree on the risk: a waterfall stops at the first answer whether or not it is right, so a looser provider early in the chain ends the search with a weaker address. Hunter also advises capping the chain at two or three providers, since many tools license the same upstream data.

Verification is a separate step

A waterfall decides who answers, not whether the answer is right. Hunter's explainer advises running every found address through the same verifier at the end, so "valid" means one thing in your list. The Anymail test likewise scored every returned email with independent verifiers, not the finder's own verdict.

Match-rate claims are vendor claims

These differ in who was tested, how "found" was counted (returned or verified) and who ran the test. Run your own: take 50 to 100 contacts from your segment, put each option's results through one independent verifier, send nothing, and divide spend by the number that come back valid. A sample that small gives a rough read, not a precise rate.

How to check a business email address: valid, catch-all, risky, unknown

Why catch-all addresses cannot be confirmed with certainty

A verifier asks the receiving server whether it would accept mail for an address, and the protocol does not guarantee a useful answer. RFC 5321 lets a server say it cannot verify a user but will still accept the message, and notes that some servers do not check recipients until after the message text arrives. ZeroBounce says a catch-all address is impossible to validate without sending a real email and waiting for a bounce.

Some verifiers go further and estimate, from extra signals, whether a catch-all mailbox is real. The Anymail test used one such service for catch-all domains and calls those results best-effort.

It is also configuration. In Microsoft 365, an authoritative domain rejects mail for unknown recipients, while an internal-relay domain passes it to another server. Google Workspace offers a catch-all mailbox for mail sent to users who do not exist.

How common is it? Two vendors published similar headline figures in 2026 and read them differently:

• Scrupp (snapshot of 5 October 2026, 4,687,209 checks it ran for customers) found 31.9% of addresses came back catch-all, and 26.5% of domains returned catch-all at least once.
• BounceZero (published 13 July 2026) reports that 33.1% of its checks hit catch-all domains, then argues the figure misleads: 64.9% of that catch-all came from Yahoo and T-Online, consumer providers that do not reveal whether a mailbox exists. For verifiable business mail (Microsoft 365 and Google Workspace) it reports 8.2% true catch-all.

Both vendors sell verification or prospecting products, and both samples skew toward outbound lists. The safe reading: "catch-all" mixes "accepts everything" with "will not say", so the share depends on your list. For a rule on sending to these addresses, see the catch-all guide.

Is it legal to email an address you found? EU, UK and US notes

This summarizes primary texts for three common cases. It is not legal advice.

• A work address with a name in it is personal data. GDPR defines personal data as information about an identifiable person and lists a name as an example identifier. The ICO says UK GDPR applies to an address like firstname.lastname@company even though PECR's marketing-email consent rule does not cover corporate subscribers (PECR treats an employee's address as the employer's, and sole traders count as individuals). The ICO says its guidance is under review because of the Data (Use and Access) Act.
• Finding it elsewhere triggers Article 14. When data does not come from the person, Article 14 requires you to give them, among other items, your identity, the purposes and legal basis, the source (including whether it was publicly accessible) and their rights. The deadline is a reasonable period and at most one month, or at the latest the time of your first message if you use the data to contact them. The UK GDPR text has the same structure. Article 14(5) lists exceptions, such as the person already having the information.
• A waterfall inherits its providers' sourcing. Hunter, which sells a single-provider finder, argues that a waterfall is only as compliant as its least transparent provider.
• US senders. 15 U.S.C. 7704(b)(1) treats a message that already breaks section 7704(a) as an aggravated violation when the sender knew, or knowledge can fairly be implied, that the address was collected by automated means from a site that said it would not transfer addresses, or generated by automated permutations of names, letters or numbers. The text we read does not say whether trying a few patterns for one named person counts.

The legal basis question, Germany and what a first-contact notice should say are in the GDPR cold email guide. Ask a lawyer about your own situation.

How FoxKnock finds and verifies work emails

FoxKnock's email finder runs a waterfall of specialist finders. Verification is a separate step with its own price.

• Find. For a named person and a company domain, it tries Icypeas, LeadMagic, Findymail, Hunter and Prospeo in that order and stops at the first valid result. Otherwise it keeps the best candidate (catch-all, then risky, then unknown). Only when no provider returns an address does it try a pattern guess, checked with an MX lookup, and a guess is never reported as valid. A provider takes part only when a key for it is configured, either the platform's or your own.
• Charged only when found. At default credit prices (which may change), a find costs 10 credits, charged only when the result is valid or catch-all.
• Verify. At default prices verification costs 1 credit: in-house checks first (syntax, disposable domains, MX lookup, role accounts), then MillionVerifier, ZeroBounce and Reoon. FoxKnock does not probe mailboxes over SMTP itself, so an address is reported valid only when a vendor says so. A role account such as info@ is reported as risky.
• Catch-all policy. By default catch-all addresses are capped at 10% of a sequence's contacts. You can exclude them instead.
• Re-checks and refunds. Contacts last verified more than 14 days ago are re-verified before sending (1 credit). If an address FoxKnock found hard-bounces, the find credits are refunded automatically, once. The verification credit is not refunded, and imported addresses were never charged.
• Bounce guard and provenance. A mailbox pauses automatically above 2% bounces over its last 100 sends (after at least 20 sends). Each enriched field records its provider, source URL (if any), confidence and retrieval time.

FoxKnock launched in October 2026 and has no usage history to report, so any find rate we quoted would be invented.

To try it on a handful of your own contacts, sign up free. The free plan has 500 one-time credits, no card, granted once your email is verified. At default prices a found and verified email costs 11 credits ($0.11 at list price), so that covers about 45 of them. See pricing for current numbers.