How to Find the Correct Email Address (and Verify It Before You Hit Send)
You craft the perfect cold email - sharp subject line, personalized opener, clear CTA - and it bounces. Not because the copy was wrong, but because the email address was. Email lists decay roughly 28% per year, and once your bounce rate crosses 2%, ISPs start throttling your entire domain. The address matters more than the message.
Most advice on finding emails is outdated, recommending tools like Rapportive and Snapbird that haven't worked in years. Here are five methods that actually work in 2026, plus a verification step most people skip.
What You Need (Quick Version)
- One email, fast? Try Google dorking or the permutation trick below. If you don't find it in five minutes, switch to a tool.
- Emails at scale? Use an email finder with built-in verification so you get a valid address on every lookup.
- Before you send anything: Verify. Every time. A single bad batch can tank your sender reputation for weeks.
Five Ways to Find the Right Email
Check the Company Website
Start with the obvious. About pages, team bios, and press releases often list direct emails for key contacts. Smaller companies especially tend to publish founder emails on their contact page. It takes 60 seconds and costs nothing - always check here first.
Google Dorking
Google dorking combines search operators to surface emails that are publicly indexed but buried deep in results:
"John Smith" @company.com - finds indexed emails directly
"Jane Doe" site:company.com email - surfaces email mentions on the company site
"Full Name" filetype:pdf OR filetype:xlsx - catches emails buried in downloadable documents
DuckDuckGo can actually be better than Google for @domain searches because Google tends to surface social profiles instead of raw email matches.
Email Permutation
This is the best free method if you only need one or two addresses. Most companies follow predictable email patterns - first.last@company.com, f.last@company.com, firstl@company.com, first@company.com - and you can generate every likely combination, then verify which one's real.
Mailmeteor's permutator generates dozens of combinations automatically. Metric Sparrow's Email Permutator+ cranks out up to 46 per input. Quick trick: paste the candidates into Gmail's "To:" field and hover over each. If one shows a profile image, that's almost certainly the valid address.
Don't send to all the permutations. Blasting five wrong addresses at the same domain is a fast way to get flagged as spam.
Use an Email Finder Tool
This is what most teams end up doing, and for good reason. Email finder tools combine pattern matching, web scraping, and real-time verification to return a confirmed address in seconds. The difference between tools comes down to accuracy, coverage, and cost per valid result.
We've tested most of the major players. Prospeo is what our team relies on - you search by name, company, or filters across 300M+ profiles, and every result comes back pre-verified through a proprietary 5-step process. No separate verification step needed. At roughly $0.01 per email with 98% accuracy and a 7-day data refresh cycle, it's the best cost-per-valid-contact option we've found.
| Tool | Free Tier | Starting Price | Best For |
|---|---|---|---|
| Hunter.io | 50 searches/mo | $34/mo | Domain-level research |
| Apollo.io | Yes | ~$49/mo/user | All-in-one sales stack |
| Snov.io | Trial credits | $39/mo | Drip campaigns included |
| RocketReach | Limited | $39/mo (70 lookups) | Large professional database |
Skip RocketReach if you're on a budget - 70 lookups per month at $39 is the worst value on this list. Apollo is solid if you want an all-in-one sales stack, but its email accuracy doesn't match dedicated finder tools. A recent benchmark by EmailTooltester comparing multiple email finders found massive variance in actual deliverability - vendor accuracy claims and real-world results rarely match.
Waterfall Enrichment
When you're building lists of hundreds or thousands of contacts, no single tool covers everyone. Waterfall enrichment chains multiple data sources sequentially - your primary tool handles the first pass, then a second fills the gaps on contacts that came back empty. This approach delivers roughly 30% more emails than relying on any single provider.
Here's the thing: waterfall enrichment is overkill for teams sending fewer than 500 emails per month. If that's you, pick one good tool and move on.
Other methods worth trying: checking WHOIS records for domain contacts, searching GitHub commit histories for developer emails, or exporting your existing network's contact data from your CRM.
You just read five ways to find the correct email address. Prospeo combines all of them - pattern matching, web scraping, and real-time 5-step verification - into a single lookup across 300M+ profiles. Every result is pre-verified with catch-all handling, so you skip the separate verification step entirely. At $0.01 per email with 98% accuracy, one bad address costs less than a penny to avoid.
Find and verify the right email in one click - not five steps.
How to Verify Before Sending
Most guides skip this entirely, so let's break it down. When you verify an email, the tool performs an MX lookup to find the domain's mail server, then initiates an SMTP handshake - knocking on the door and asking "does this mailbox exist?" without delivering a message. A 250 response means valid. A 550 means it doesn't exist.
The tricky part is catch-all domains. These accept mail sent to any address at the domain, so the server always returns 250 - even for completely made-up addresses. In our experience, catch-all domains are a major reason "verified" lists still bounce. Look for verification tools that go beyond basic SMTP checks. Prospeo's 5-step process includes catch-all handling, spam-trap removal, and honeypot filtering, which is why its 98% accuracy holds up in practice rather than just on a marketing page.
The consensus on r/coldemail is pretty clear: cleaning your list protects deliverability more than perfecting your copy ever will.
Compliance in 30 Seconds
Three regulations to know before you send:
CAN-SPAM - Include a physical address, honor opt-outs within 30 days, use truthful headers. Penalties run $51,744-$53,088 per violation.
GDPR - Cold B2B email is permitted under legitimate interest, Article 6(1)(f), but document your reasoning and honor opt-outs immediately. Fines reach EUR 20M or 4% of global revenue.
CASL - Requires express or implied consent. Implied consent covers existing business relationships; process unsubscribes within 10 business days.
Include your physical address in every email, honor every opt-out, and document where you sourced each contact. This isn't optional.
Email lists decay 28% per year, and the article above explains why catch-all domains fool basic verification tools. Prospeo refreshes its entire database every 7 days (not the 6-week industry average) and filters out spam traps and honeypots automatically. Teams using Prospeo cut bounce rates from 35%+ to under 4% - protecting sender reputation while tripling pipeline.
Your domain reputation is worth more than a free tool. Protect it.
FAQ
Is it legal to find someone's email and cold-email them?
Yes, in most jurisdictions. CAN-SPAM requires truthful headers, a physical address, and opt-out compliance but doesn't require prior consent for B2B. GDPR permits cold B2B email under legitimate interest if you document your reasoning and honor opt-outs immediately.
How accurate are email finder tools?
Accuracy varies wildly - most claim 85-95%, but independent benchmarks show results often fall short. Prospeo delivers 98% verified accuracy with a 7-day refresh cycle; Hunter and Apollo typically land in the 79-87% range. Choose a tool that verifies at the point of lookup rather than requiring a separate step.
Can I verify an email without sending a message?
Yes. SMTP verification checks whether a mailbox exists by initiating a handshake with the mail server without delivering any content. Most verification tools automate this, though catch-all domains can still return uncertain results - look for providers with dedicated catch-all handling.
What's the best free way to find the correct email address?
Email permutation is the most reliable free method. Generate common format variations (first.last@, flast@, first@) using a free permutator tool, then verify each candidate with a free SMTP checker. If you need more than one or two addresses, Prospeo's free tier gives you 75 verified emails per month - faster than manual permutation and more reliable.