How to find a business email address: domain, format and verification

This guide is for SDRs, founders and anyone who needs to email a specific person at another company and doesn't have their address. It works for one person or a short list. It covers how to confirm the company's email domain, find its address format, build and verify the address, and what each verification result means. If you need hundreds of addresses, the same method applies, but you'll want a tool for the lookups.

If you don't yet know who to email, start with how to find decision makers, which shows how to work out who owns the problem at a company.

How to find a business email address, step by step

1. Confirm the company and its email domain. The domain a company uses for email isn't always its website domain. Companies rebrand, run regional sites or keep an older domain for mail. Check the contact page and any published addresses, and look up the domain's MX records (below).
2. Look for the address where it's already published. The person's bio on the company's team page, a press release that names them as the media contact, a conference speaker page, a published report or a PDF. A search for the person's name together with "@" and the company domain often finds these.
3. Work out the company's address format. Collect two or more published addresses from the same domain, ideally from different people. If they follow the same pattern, that's the format.
4. Build the address. Apply the format to the person's name as they use it at work. Watch for nicknames, hyphenated surnames and common names, where companies sometimes add a number or a middle initial.
5. Verify it. Run the address through an email verification tool, which checks the syntax, the domain's mail servers and whether the server accepts that mailbox.
6. Decide whether to send. Act on the result using the table below. "Valid" means send; "accept-all" and "unknown" need care.
7. If you can't confirm it, use another route. Call the main number and ask for the person's email, message them on LinkedIn, or ask someone you know at the company. A role address such as info@ rarely reaches the person you want.

How to find a company's email domain

Every domain that receives email publishes MX (mail exchanger) records in DNS, and the internet's mail standard, RFC 5321, says sending servers look up the MX record first to find where to deliver. You can do the same lookup:

• On Mac or Linux, run dig +short MX company.example in a terminal.
• On Windows, run nslookup -type=mx company.example in a command prompt.
• Without a terminal, search for "MX lookup" and use any free web tool.

What the results tell you:

If the website is on one domain and every published address uses another, the published addresses win.

Common business email formats

Apply each format to the person's name. Here's what they look like for a fictional Elena Marsh at company.example:

Small companies often use first names only. Larger ones tend to use full names or initials because first names collide. But don't rely on general patterns when the company has published its own: two real addresses beat any rule of thumb.

How email verification works, and its limits

A verification tool checks three things: that the address is correctly formed, that the domain has working mail servers, and whether the server will accept mail for that mailbox. For the last step, the tool starts a mail conversation with the server and asks whether it will accept a message for that address, then stops before sending anything.

That last check has limits built into how email works. RFC 5321 includes a command (VRFY) for asking a server whether an address exists, but it lets sites disable it for security, and many do, because spammers used it to harvest addresses. Some servers accept mail for every address and bounce it later, or never. These are called accept-all or catch-all domains, and no tool can confirm a specific mailbox on them.

Why it matters: addresses that bounce tell mailbox providers you don't know who you're writing to. A few bounces from a careful one-to-one send are normal. A batch of guessed addresses with a high bounce rate can push your future emails toward spam folders, including the ones to people who wanted them.

Worked example: finding a facilities director's address

Illustrative example. The companies, people and addresses are fictional, to show the method.

The seller: Crestview Commercial Cleaning (crestview.example). The target: Elena Marsh, Director of Facilities at Harmon Property Group, which manages 22 office buildings. Her role came from the company's leadership page.

Step 1: the domain. The website is harmonpg.example. An MX lookup on harmonpg.example returns no mail servers. The site's footer lists the office address and a contact form, but no email.

Step 2: published addresses. A search for the company name with "@" finds two press releases. Both list a media contact at a different domain: j.patel@harmonproperty.example and r.okafor@harmonproperty.example. An MX lookup on harmonproperty.example returns mail servers. So harmonproperty.example is the email domain; the website domain was a rebrand.

Step 3: the format. Two addresses from two different people, both first initial, a dot and the surname. Format confirmed: f.last.

Step 4: build it. e.marsh@harmonproperty.example.

Step 5: verify. The verification tool returns accept-all. The domain accepts everything, so the tool can't say whether Elena's mailbox exists.

Step 6: decide. The format is confirmed by two published addresses, and this is a single, careful email, so the risk is low. Crestview also called the main number: the receptionist confirmed the address and mentioned that Elena handles cleaning contracts for all 22 buildings. That was worth more than the address.

What the guess would have been: without step 2, Crestview would have emailed elena.marsh@harmonpg.example, a domain nobody at the company uses for email, and almost certainly bounced.

Tools and sources to use

If you're comparing email finder tools, see the best email finder comparison. For whole lists, Bebop finds the matching companies and the right contacts at each, with their contact details, so you start from the person instead of a guess. Verify addresses before any large send, whatever the source.

The rules that apply

This is general information, not legal advice.

• CAN-SPAM applies to business email. The FTC says the law makes no exception for business-to-business email. Commercial emails need accurate headers, an honest subject line, your physical postal address and a working opt-out.
• Generated permutations are an aggravating factor. If an email otherwise breaks CAN-SPAM, it's an aggravated violation when the address was obtained by automated means that generate possible addresses by combining names, letters or numbers into numerous permutations. Building one address from a confirmed format by hand is a different thing from blasting every permutation to see what sticks, and only the first is good practice.
• In the UK, a named work address is personal data. The ICO says the electronic mail rule in PECR doesn't apply to corporate subscribers, but you must identify yourself and give a valid opt-out, and an address that identifies an individual is personal data under UK GDPR, even in a business context. Sole traders and some partnerships are treated as individuals and need consent or a soft opt-in.

Self-check before you send

• You've confirmed which domain receives the company's mail.
• The format comes from at least two published addresses at that domain, or you've confirmed the address another way.
• The verification result is valid, or it's accept-all with a confirmed format and you're sending a single email.
• You're writing to a person, not a role inbox, unless you're asking who the right person is.
• Your email includes your postal address and a way to opt out.

Common mistakes

• Assuming the website domain is the email domain. Check the MX records and published addresses.
• Trusting a pattern from another company. first.last is common, not universal. Use this company's own addresses.
• Treating accept-all as valid. It means unconfirmed. Send carefully, one at a time.
• Emailing every permutation. It produces bounces, damages your sender reputation and is an aggravating factor under CAN-SPAM.
• Ignoring the phone. One call to the front desk can confirm the address and tell you who really decides.

Next step: once you have the address, write something worth reading with how to write a cold email.