Picture this.

You’ve spent three weeks writing the best link building case study in your niche.

It’s good. Like, genuinely good.

You know exactly which 50 publications would cite it. You’ve got their URLs. You’ve got the editor names. You’ve even rehearsed your pitch.

There’s just one problem.

You don’t have their emails.

And the LinkedIn message you sent? Read. No reply.

Sound familiar?

Here’s the thing: every link building campaign you’ll ever run lives or dies on this one skill — finding the right person’s email. Not their assistant. Not info@company.com. Their email.

Good news: in 2026, this is more solvable than it’s ever been. The tools are sharper. The methods are well-documented. And there are some genuinely free tricks that work shockingly well.

In this guide, you’ll get 9 proven methods for finding email addresses, ranked roughly from fastest to most thorough. We’ll cover free tools, paid tools, manual sleuthing tricks, Google operators that almost nobody uses, and the verification step that stops you destroying your sender reputation.

Let’s get into it.

First, a Quick Reality Check

Before we dive in, here’s what the data says about email finding in 2026:

What the Data Says	The Number
Apollo’s email accuracy in independent benchmarks	~73%
Hunter.io high-confidence email accuracy	~85%
Snov.io verified-rate in 5,000-contact benchmark (Anymail Finder)	20.1%
Hunter.io verified-rate in same benchmark	37.6%
Manual email guessing accuracy (no verification)	40–50%
Saleshandy Connect on LinkedIn profiles (2026 test)	95/100 found
LinkedIn users who actually publish their email on profile	~30%
Email list decay rate (people changing roles)	~2% every 4 weeks
Average value of a verified B2B email address	$48.50

Two things should jump out.

First, no tool is 100% accurate. Even the best ones get it wrong 15% of the time. So you always verify before you send.

Second, your data goes stale fast. A list you scraped six months ago is now 25% wrong. Re-verify every list before every campaign.

OK. Methods.

Method 1: Try Their Website First (the 30-Second Test)

Before you do anything clever, do the boring thing.

Go to their website. Click “Contact.” Click “About.” Click the team page. Scroll the footer.

You’d be amazed how often the email is right there.

If you skip this step and jump straight to a paid tool, you’re paying credits for emails that were free five seconds away.

This works particularly well for:

Smaller blogs and indie sites (almost always have a personal email listed)
Journalists and writers (often have a contact section on their author page)
Agencies (often list the founder or head of marketing directly)
SaaS companies (usually list the press contact, partnerships contact, or founder)

Where to look:

Footer of the homepage
/contact page
/about page
Author bio pages (especially on blogs)
Press / media kit pages
“Write for us” or guest contributor pages

⏱ Time: 30 seconds. ✓ Hit rate: 25–40% on smaller sites, 5–10% on big publications. 💰 Cost: Free.

Method 2: The Google Operator Method (Free + Surprisingly Effective)

This is the trick that almost nobody teaches you.

Google indexes massive amounts of contact information that’s technically public — old press releases, conference speaker pages, job postings, archived bios, GitHub commits. Most of it never surfaces in normal search.

But Google operators force it to.

Here’s the playbook.

The basic name-and-domain operator

Open Google. Type:

“firstname lastname” “@companydomain.com”

Example:

“Sarah Chen” “@stripe.com”

This finds anywhere on the web where Sarah Chen’s name appears next to a Stripe email address. Press releases. Conference speaker bios. Archived staff pages. Old podcasts. It’s all there.

The format-discovery operator

Sometimes you can’t find your specific person — but you can find anyone at the company. Once you know the email format the company uses, you can guess your target’s email.

Try:

“@companydomain.com” -site:companydomain.com

This searches for anything containing the company’s email pattern, excluding their own website. So you’ll find their employees mentioned on third-party sites — Crunchbase, LinkedIn, conference pages, news articles.

Once you find two or three emails, the format becomes obvious. Most companies use one of these patterns:

Format	Example (Sarah Chen)
firstname.lastname@	sarah.chen@company.com
firstname@	sarah@company.com
flastname@	schen@company.com
firstnamelastname@	sarahchen@company.com
firstname.lastinitial@	sarah.c@company.com

The job-posting trick

Recruiters paste their personal emails into job postings constantly. Google indexes them. So:

“@companydomain.com” “send your” OR “email” “hiring” OR “recruiter”

This will surface dozens of contact emails in the recruiting team — and once you have them, you’ve got the format.

⏱ Time: 2–5 minutes. ✓ Hit rate: 50–70% if you’re patient. 💰 Cost: Free.

Method 3: LinkedIn (the Real Way)

Most people get LinkedIn email-finding wrong.

They send a connection request. Wait three days. Send a sad little message: “Hey, can I get your email?”

Don’t do that.

Here’s the thing about LinkedIn in 2026: roughly 30% of users actually publish their email right on their profile. You just have to know where to look. And for the other 70%, there’s a smarter way to use the platform.

Step 1: Check Contact Info

Go to the prospect’s profile. Right under their headline and photo, there’s a button that says “Contact info.” Click it.

Sometimes — surprisingly often — there’s an email address sitting there in plain text. People share it but forget it’s there. You’re welcome.

Step 2: Check the About section

Some people don’t put their email in the official Contact Info field, but they do mention it in their About section bio. Scroll through. Check for “@” symbols, “reach me at,” “DM me here.”

Step 3: Check the Featured section

This is where people pin their best content. If they’re a blogger, journalist, or creator, their pinned posts often link to their personal site or Substack — which usually has their email.

Step 4: Connect first, then ask (warm prospects only)

If a connection request gets accepted, then you can ask. Not before. Cold-asking for an email from someone you haven’t connected with is a fast track to being ignored or marked as spam.

⏱ Time: 1–2 minutes per profile. ✓ Hit rate: 25–35% (when their email is publicly listed). 💰 Cost: Free.

Method 4: Hunter.io (the Workhorse)

If you’re going to pay for one email finder in 2026, this is probably it.

Hunter does one thing and does it well: you give it a domain, it gives you back the verified email patterns and known emails associated with that domain. It crawls roughly 100 million websites, indexes the email addresses it finds, and verifies them with confidence scores.

In independent benchmarks, Hunter scored a 37.6% verified-rate on a 5,000-contact test (Anymail Finder, 2025) — nearly double Snov.io’s 20.1% on the same list. High-confidence emails come back at roughly 85% accuracy.

How to use it (the fast workflow)

Install the Hunter Chrome extension.
Go to the prospect’s company website.
Click the Hunter icon — it’ll show you every email it has indexed for the domain, plus the email format the company uses.
If your specific person isn’t there, use the email format with their name.
Run the predicted email through Hunter’s Email Verifier before sending.

The free plan

Hunter gives you 25 free searches and 50 verifications per month. For most solo link builders, that’s plenty. Paid plans start at $34/month for the Starter tier and scale up to $299/month for high-volume prospecting.

Where Hunter falls short

Hunter’s pattern-matching approach works beautifully for companies with standard email formats. It struggles with:

Companies using catch-all email configurations (which look valid but aren’t)
Smaller indie sites where the founder uses a mix of personal and business addresses
Anyone using role-based emails (info@, hello@, contact@) instead of personal ones

For everything else, it’s the cleanest tool on the market.

⏱ Time: 10 seconds. ✓ Hit rate: ~85% on high-confidence results. 💰 Cost: Free for low volumes; $34+/mo paid.

Method 5: Apollo.io (When You Need Volume)

Apollo is the opposite of Hunter.

Where Hunter is a scalpel, Apollo is a sledgehammer. It has one of the largest contact databases on the market — 275 million contacts — and it’s built for sales teams who need to enrich huge prospect lists fast.

The trade-off? Accuracy.

Independent testing puts Apollo’s email accuracy at around 73% — meaning roughly 1 in 4 emails will bounce or fail to deliver. That sounds bad, and at scale it is. A 1,000-contact campaign at 73% accuracy means 270 bounces. That’s enough to torch your sender reputation in a week.

Apollo’s email accuracy is around 73%. That means roughly 1 in 4 emails will bounce or fail to deliver. At scale, you must verify before sending.

When Apollo is the right call

Building large prospect lists from filters (industry, role, company size, tech stack)
LinkedIn Sales Navigator workflows
When you need an all-in-one platform with sequencing built in
Anywhere you’d rather have 1,000 partly-accurate contacts than 200 highly-accurate ones

When to skip Apollo

Small, high-quality prospect lists where bounce rate matters
Niche industries where Apollo’s database is thin
Anywhere you can’t afford a verification step before sending

Pricing starts at ~$49/user/month — but the free tier is generous and worth testing first.

⏱ Time: 5–10 seconds per contact. ✓ Hit rate: ~73% (verify before sending). 💰 Cost: Free tier; $49/user/mo paid.

Method 6: Snov.io (the All-in-One)

Snov.io is what you reach for when you want email finding and sequencing and verification and a basic CRM in one tool, on a small budget.

It’s not the most accurate finder out there. In the same Anymail Finder benchmark, Snov.io returned a 20.1% verified-rate on 5,000 contacts — about half what Hunter pulled. But what it lacks in raw finding accuracy, it makes up in workflow integration.

If you’re already running outreach campaigns through Snov.io’s sequencer, having the email finder built into the same dashboard saves real time. The Chrome extension grabs emails directly from LinkedIn search results — useful when you’re working through Sales Navigator lists.

Pricing starts at ~$30/month for 1,000 credits. Watch the credit math, though — finding costs 1 credit and verification costs 1 credit, so 1,000 credits actually equals 500 verified emails.

⏱ Time: 10 seconds. ✓ Hit rate: ~20–60% depending on the niche. 💰 Cost: Free trial; $30+/mo paid.

Method 7: The GitHub Trick (the One Almost Nobody Knows)

This one is sneaky.

Anyone who has ever pushed code to GitHub has — almost certainly — committed it from an email address that’s now sitting in their commit history. Forever. Public.

This includes:

Software developers (obviously)
Technical founders
Engineering managers
DevOps and SREs
Surprisingly often: marketing leads who messed about with a personal site

How to do it

Find the person’s GitHub profile (just Google their name + GitHub).
Click on any of their public repositories.
Click the “Commits” tab.
Click on a specific commit.
Append .patch to the URL — like /commit/abc123.patch
In the patch file, look for “From:” and “Author:” lines. The email is right there.

Many people use their personal Gmail for early commits and switch to a work email later — so you’ll often find both. The work email is what you want for outreach to a specific company.

⏱ Time: 2–3 minutes. ✓ Hit rate: 80%+ for anyone with a public GitHub. 💰 Cost: Free.

Method 8: WHOIS for Independent Sites

If you’re trying to reach the owner of a personal blog, an independent niche site, or a small agency, WHOIS records are your friend.

Every domain that’s registered in the world has a WHOIS record. Most have privacy enabled by default these days — but a surprising number of older domains, smaller sites, and country-specific TLDs (.uk, .de, .ca, .co.uk) still have the registrant’s email visible.

How to check

Go to whois.com or use any WHOIS lookup tool.
Enter the domain.
Look for the “Registrant Email” field.

If it’s hidden behind a privacy service (whoisguard, privacyprotect, etc.), move on. If it’s visible, you’ve got the owner’s email — usually the actual founder, not a gatekeeper.

⏱ Time: 30 seconds. ✓ Hit rate: 30% on small sites, 5% on big ones. 💰 Cost: Free.

Method 9: Just Ask (Yes, Really)

This is the method everyone forgets.

If you’ve already exchanged a few messages with someone — on LinkedIn, on X, in a Slack community, in a comment thread — just ask for their email.

“Hey [name], I’d like to send you a longer thing on this — what’s the best email to use?”

That’s it. That’s the technique.

This works because:

It’s not creepy (you’re already in conversation)
It’s clearly value-focused (you have something specific to send)
It moves the conversation to a channel you can both control
It’s faster than any tool

The catch: it only works for warm-ish prospects. For cold first-touch outreach, use the methods above.

⏱ Time: 10 seconds. ✓ Hit rate: 70%+ for warm prospects. 💰 Cost: Free.

The Verification Step (Don’t Skip This)

OK. You’ve got an email.

Whether you found it on a website, guessed the format from Google, pulled it from Hunter, or extracted it from a GitHub commit — verify it before you send.

Why this matters:

A bounce rate above 2% damages your sender reputation in days
A bounce rate above 5% can get your sending domain blacklisted
Email lists decay roughly 2% every 4 weeks — yesterday’s verified email may be invalid today

Bounce rate above 5% can get your sending domain blacklisted. Verify every email — even the ones you found yesterday.

Free verification tools

Hunter Email Verifier (50 free verifications/month)
NeverBounce (free trial, then paid per credit)
ZeroBounce (free trial, then paid per credit)
Mailtester.com (free, simple, no signup)

How verification works

Verification tools check three things, in order:

Syntax — does the email follow the right format (no obvious typos, valid characters)?
Domain — does the @companydomain.com part exist and accept mail?
Mailbox — does that specific email address exist on the server, and will it accept mail without bouncing?

Most tools return a confidence score. Anything above 90% is safe to send. Anything between 70–90% should be sent cautiously, ideally not in your first wave of outreach. Below 70% — skip it. The bounce risk isn’t worth it.

The catch-all problem

Some companies configure their mail servers to accept any email at their domain — even ones that don’t exist — to avoid bounces. These are called “catch-all” configurations, and they’re a verification nightmare.

If a verification tool tells you an email is “catch-all” or “accept-all,” you don’t actually know whether it works. Two options:

Send a test email to a non-existent address at the same domain (e.g., aaaaaa@theirdomain.com). If it bounces, the domain isn’t catch-all and your real email is probably valid. If it doesn’t bounce, you’re flying blind.
Just send to it anyway, but in your second or third batch — never in your first send from a new domain.

The Complete Email-Finding Workflow (the One You Should Actually Use)

Here’s how the methods above stack up in practice. This is the workflow most experienced link builders use in 2026:

Try the website first (30 seconds). Maybe you get lucky.
If not, run the Google name+domain operator (2 minutes).
If still nothing, fire Hunter at the domain to get the email format and any indexed addresses.
Use the format to predict your specific target’s email.
Verify the predicted email through Hunter’s verifier or NeverBounce.
If it comes back as catch-all, do a sanity-check bounce test.
Send.

Total time per email: 3–5 minutes for difficult prospects, 30 seconds for easy ones.

For larger campaigns (100+ prospects), batch this through Hunter’s Domain Search (or Apollo if you need volume), export the list with confidence scores, and verify the entire list before importing into your sequencer.

If you want a deeper look at the tools that automate this end-to-end, our review of the best link building tools available in 2026 goes through the full prospecting and outreach stack. And once you have the email, the next question is what to actually write — for that, our guide to link building outreach: templates, tips and tools walks through the messaging side.

Quick Word on Legality (the 60-Second Version)

Finding professional email addresses is legal almost everywhere — as long as the addresses are publicly available and you follow the rules around how you use them.

In the US (CAN-SPAM)

Cold B2B email is legal.
You must include a working unsubscribe option.
You must include a physical mailing address.
Subject lines and “from” names must not be deceptive.
Penalties run up to $53,088 per violation, so don’t be sloppy.

B2B cold email is permitted under “legitimate interest” — but the bar is higher.
You must offer a clear, easy opt-out in every email.
You must respect opt-out requests promptly.
Personal email addresses (gmail.com, yahoo.com etc.) for individual sole-traders are treated more strictly than role-based business emails.
Honor any “do not contact” lists in your industry.

None of this is legal advice. If you’re scaling outreach to thousands of contacts in regulated regions, get a lawyer to review your process. For most link builders working through a few hundred prospects per month, sticking to the rules above keeps you safe.

5 Email-Finding Mistakes That Cost You Links

Mistake 1: Sending to info@, hello@, or contact@

These role-based addresses go to assistants, customer support agents, or worst of all — a black hole. Reply rate from these is typically 1–2%. Reply rate from a personalised editor’s email is 8–15%. Always find the actual person.

Mistake 2: Skipping verification

Even at $0.01 per verification, the cost is trivial compared to the damage of a 10% bounce rate. Verify everything. Every time.

Mistake 3: Trusting last month’s list

Email lists decay 2% every four weeks. The list you scraped at the start of the quarter is now significantly less accurate. Re-verify before every send.

Mistake 4: Using one tool for everything

Different tools have different strengths. Hunter is great at small companies and clean domains. Apollo is great at big SaaS companies. Snov works well for mid-market. The pros stack 2–3 tools and waterfall through them — start with the cheapest, escalate to the most accurate when needed.

Mistake 5: Spending an hour on a single email

If you’ve spent more than 5 minutes finding one email, move on. Either the prospect isn’t important enough to justify the time, or their email isn’t findable through normal channels — in which case a LinkedIn message or contact form might be your better bet anyway. Time spent finding one impossible email is time not spent finding ten easy ones.

Frequently Asked Questions

What’s the best free way to find someone’s email?

The Google operator method, hands down. Type “firstname lastname” “@companydomain.com” into Google. If that doesn’t work, try Hunter’s free plan (25 free searches per month) or the GitHub trick if your prospect is technical. Combine all three and you’ll find around 70% of emails without paying anything.

Is finding email addresses legal?

Yes — finding publicly available professional email addresses is legal in the US, UK, and EU. Sending to them is also legal under CAN-SPAM (US) and GDPR’s legitimate-interest provision (EU/UK), provided you include an opt-out option, identify yourself honestly, and respect unsubscribe requests.

How accurate are email finder tools?

It varies wildly. Hunter scores around 85% on high-confidence results. Apollo averages 73%. Snov.io’s verified-rate on a 5,000-contact independent benchmark was 20.1%. The takeaway: no tool is perfect, and you should always verify with a separate verification tool before sending.

Should I use Hunter or Apollo?

Use Hunter if you want clean, accurate emails for small to medium prospect lists. Use Apollo if you need volume — it has 275 million contacts but accuracy is around 73%, so you’ll need a verification step. Many experienced teams use both: Apollo for list-building, Hunter for verification and gap-filling.

How do I find an email if the company has a catch-all server?

Catch-all configurations make verification unreliable. Two workarounds: (1) Send a test email to a deliberately non-existent address at the same domain — if it bounces, the domain isn’t catch-all and your real email probably works. (2) Send your real email anyway, but as part of your second or third batch from your sending domain, not your first.

How often should I re-verify my email list?

Email lists decay roughly 2% every four weeks as people change roles. For active outreach campaigns, re-verify before every send. For long-term lists held in storage, re-verify before each new campaign — even a list verified three months ago is now meaningfully less accurate.

Is it okay to use the same email format guessing tool for all companies?

No. Different companies use radically different formats. firstname.lastname@ is the most common (~40% of B2B companies), but firstname@ is common at startups, flastname@ is common at enterprises, and many older companies have their own quirks. Always confirm the format from at least two known emails at the company before guessing your target’s address.

What if I can’t find an email at all?

If you’ve exhausted the methods above and still can’t find an email, three options: (1) Use the company’s contact form — surprisingly, well-written contact-form messages get through more often than people think. (2) Send a polite LinkedIn message asking for the best email to send a longer note to. (3) Move on. Not every prospect is reachable, and time spent chasing one impossible email is time not spent acquiring three findable ones.

Do email finder tools work for personal Gmail addresses?

Mostly no. Tools like Hunter and Apollo focus on professional email addresses — domains owned by companies. Personal Gmail, Yahoo, or Outlook addresses are harder to find through these tools, and using them in cold outreach raises legal issues under GDPR. For B2B outreach you should focus on professional email addresses anyway — they’re more reliable, more legitimate, and they get higher reply rates.

Wrapping Up

Finding email addresses isn’t the hard part of link building.

It just feels hard the first few times you do it, because nobody ever taught you the operators, the GitHub trick, the WHOIS lookup, the Google patterns. Once you know the playbook, you can find 80% of emails in under three minutes.

The hard part is what comes after — writing the email, sending it at the right time, following up without being annoying, and earning the reply that turns into the link.

If you’re newer to all this, our complete beginner’s guide to link building lays out the whole landscape. Once you’ve got the foundations, our 15 link building strategies that actually work in 2026 walks through where outreach fits in the broader playbook.

And once you’ve got the email and you’re ready to write the pitch, the strategic frame for that lives in our complete guide to link building outreach — including the templates and cadence that turn a verified email address into a placed link.

Now stop reading and go find some emails.