How to Find Business Email Addresses, Ranked by Hit Rate

A list of 400 plumbers, dentists, and restaurants will break almost every email-finding guide published this year. They all assume the same prospect: a named director at a software company, with a LinkedIn profile and a [email protected] pattern you can infer from one confirmed address. Aim that playbook at local businesses and it returns close to nothing.

The tactics aren't wrong. The target is. So this guide ranks every sourcing method by the hit rate we actually see, treats corporate contacts and local businesses as the two separate problems they are, and carries the job through the steps most posts skip - verifying what you found, and getting it into a CRM without creating duplicates.

Find business email addresses: two problems, one search term

Which methods work depends almost entirely on which of these you're looking at:

• A named person at a company. You know the human, you know the domain, and the company issues addresses on a predictable pattern. Pattern inference, LinkedIn, and the big finder databases all work here.
• A local business. You may not know a person's name, the company may not have a domain at all, and the address is as likely to be a Gmail account as anything on a corporate mail server. Every corporate technique degrades, and pattern-guessing actively backfires.

The scale skew matters. The SBA Office of Advocacy's small business profiles put the US count near 33 million businesses, with roughly four in five being nonemployer firms - one-person operations with no directory, no HR system, and often no LinkedIn footprint. If you sell into that market, the standard advice was written for someone else.

A note on the percentages below: they come from our own list building rather than a published benchmark, and they swing hard by industry, country, and company size. The ranking is the durable part. Treat the numbers as rough.

How to find a company's email address: corporate targets, ranked

1. The address the company already published (70%+ for a usable address)

Before you infer anything, check what's sitting in the open: /contact, the press or media page, investor relations, job postings, support docs, and the privacy policy - which almost always names a real monitored inbox, because regulators expect one.

The catch is that these are role addresses: info@, press@, sales@. Deliverable, monitored, and routed by whoever opens them. Excellent for a first touch at a small company, weak for reaching a specific VP at a large one.

2. Pattern inference plus verification (40-60% with a full name and a real domain)

This is the workhorse. Most companies mint addresses from a handful of templates, and a small permutation set covers the bulk of them:

• first.last@, firstlast@, flast@, first@, firstl@, f.last@, last.first@, lastf@

Generate the permutations, then verify. Never send to a guess. Two things break this method outright. Catch-all domains accept every address at the SMTP layer, so verification can't tell you which permutation is real. And companies with fewer than about ten staff frequently have no pattern at all, because addresses were created ad hoc as people joined.

3. Company email finder tools and databases (variable, strong on tech and enterprise)

Hunter, Apollo, Snov.io, Prospeo, Findymail, and similar tools combine crawled addresses, contributed data, and pattern inference behind a single lookup. Credit where it's due: for a named person at a company with a website, these are the fastest route available, and their coverage of B2B tech and enterprise contacts is genuinely deep.

Our bias, stated plainly: LeadMarina is our product, and it isn't built for that job. It's built for local businesses found by niche and city. If your target is a SaaS VP of Engineering, use the tools above. The rest of this guide covers the half they're weakest on.

4. Advanced search operators (worth ten minutes, low yield per query)

Search engines index a lot of addresses their owners never meant to publish. The useful shapes:

• `site:company.com "@company.com"` - surfaces addresses published anywhere on the site, including inside PDFs.
• `"@company.com" filetype:pdf` - conference programmes, board minutes, grant applications, and press kits are full of them.
• `"firstname lastname" "@company.com"` - pins a specific person to the domain and confirms the pattern.
• `site:github.com "@company.com"` - commit metadata leaks work addresses for engineering targets.

A single found address is often worth more than the address itself, because it reveals the pattern for everyone else at the company.

5. LinkedIn and the contact-info panel (thin, and thinning)

The panel occasionally exposes a personal address, and connection requests sometimes get you one directly. Mostly, though, LinkedIn's value here is confirming the person, the spelling of their name, and their current employer - the inputs to method 2, not the answer.

6. Buying a b2b email list (last resort, and re-verify everything)

A purchased b2b email list is a snapshot of a database that was already ageing when it was compiled. People change jobs continuously and businesses close - BLS Business Employment Dynamics data has long shown that roughly half of new US establishments survive five years - so any list arrives carrying dead rows.

If you buy one, verify the whole file before the first send, and treat the vendor's stated accuracy as a claim rather than a fact. Sending to a stale purchased list is the fastest way to damage a sending domain you'll need for years.

Where the corporate playbook collapses: local business emails

Run that top six against a list of HVAC contractors and you'll watch each method fail for a specific reason:

• No pattern to infer. The business has one shared inbox, and it's frequently free-mail - [email protected] - where permutations of the owner's name mean nothing.
• No LinkedIn presence. Trades, salons, and restaurants are barely represented, so a person-first workflow has no starting point.
• Sometimes no domain at all. A meaningful share of local businesses run on a Facebook page or a listing profile and nothing else.
• Contact-form-only websites. The address exists; the site simply never shows it.
• Several valid addresses per business. info@, booking@, the owner's personal Gmail, and an old address on a directory profile can all be live - and they don't reach the same person.

One correction worth making early, because it circulates constantly: a Google Business Profile has no public email field. You get the website, phone, hours, reviews, and category - not an address. The listing is the doorway to the email, never the source of it.

How to find business emails for local businesses, ranked

1. The website's contact and footer pages (55-70% where a website exists)

Highest-yield method by a distance. Check /contact, the footer of every page, and the header. Watch for obfuscation: mailto: links whose visible text differs from the href, addresses written as "name (at) domain (dot) com", and addresses rendered as images to defeat scrapers. All three are readable by a human in seconds.

2. The pages nobody checks - privacy policy, terms, booking flows (10-20% incremental)

The most underrated source on this list. A local business that hides its address behind a contact form will still publish one in its privacy policy, because the template it copied requires a data-request contact. Terms pages, appointment confirmation screens, and careers pages leak them the same way.

3. The Facebook page About section (20-35% for consumer-facing trades)

Unlike Google's profile, a Facebook business page has an email field in its contact details, and owners fill it in far more often than you'd expect - particularly restaurants, salons, gyms, and event services. For a business with no website, this is often the only published address anywhere.

4. Directory and association profiles (15-30%)

Anywhere the owner filled out a form themselves is worth a look: Yelp, the BBB, the local chamber of commerce roster, trade association member directories, franchise locator pages, and event or sponsor listings. Chamber directories are especially good - they're published so people can make contact, so the email is the point of the page.

5. WHOIS and RDAP domain records (under 10%, and falling)

Historically the best trick in the book; now mostly closed. Since ICANN's Temporary Specification took effect in May 2018 in response to GDPR, registrant contact details in WHOIS and its successor RDAP are redacted by default, and most registrars substitute a privacy-service forwarding address.

It still occasionally pays out on older records, on some country-code TLDs, and with registrars that redact less aggressively - so it's worth one automated pass across a batch, and never worth manual time per business.

6. State registration and licensing records (5-15%, slow)

Some state entity registries and professional licensing boards publish a contact email on the annual report or licence record - contractor boards, health and liquor licensing, and cosmetology boards are the usual candidates. High effort per record, but the data tends to be current, because filing it is mandatory. The same records are the fastest route to a decision-maker's name, which how to find a business owner's name covers separately.

7. The contact form (a channel, not a source)

When a business genuinely publishes nothing, the form still lands in the inbox you wanted. It won't go into a sequence and it can't be verified, so treat it as a manual channel for high-value targets - and expect the reply to arrive from the address you were hunting for all along.

Verify before you send: safe, risky, and invalid

Finding an address is half the job. An unverified list is a bounce liability, and mailbox providers judge your domain on bounce rate and complaints long before they judge your copy.

SMTP verification checks an address without sending mail: syntax first, then whether the domain exists, then whether it publishes MX records, then a dialogue with the receiving mail server about whether that specific mailbox would be accepted. The output is a status, and each one implies a different action:

• Safe - the receiving server accepted the recipient. Sequence these.
• Risky - accepted, but with a signal worth caution: role addresses, temporary-mailbox providers, and catch-all domains all land here. Route them to manual sends rather than automation.
• Invalid - rejected. Never send, but keep it on file so you don't re-source the same dead address next quarter.

Catch-all is the one worth understanding, because it accounts for much of the risky pile. A catch-all domain accepts mail for every address at that domain, real or not, so the check comes back positive without confirming anything. It's also why pattern inference and verification stop working as a pair on some domains: every permutation you generated will appear to pass.

Local businesses bend one of these rules. Role addresses like info@ get scored as risky in generic B2B workflows, but at a six-person plumbing company info@ is the owner's inbox - the best address on the record, not the worst. The full breakdown, including when sending to risky pays off, is in email verification statuses explained.

For transparency about our own approach: every LeadMarina lead is delivered fully verified, with up to 3 SMTP-checked emails labelled safe, risky, or invalid, alongside up to 3 phones with line type and carrier, owner name where identifiable, socials, ratings, reviews, and the full business profile.

Get business emails into a CRM without duplicates

This is where a good sourcing job usually falls apart, because a business email address makes a terrible primary key. One business legitimately has several, they change, and the same address turns up across two directory profiles under different business names.

Three rules keep a recurring workflow clean:

• Match on a stable business identifier, not the email or the name. Names get re-spelled and emails get replaced; a stable listing identifier survives both. LeadMarina matches on a stable Google business identifier for exactly this reason.
• Update in place instead of re-importing. A monthly rebuild that inserts rather than updates turns 5,000 businesses into 15,000 records inside a quarter.
• Keep syncs additive. Your CRM holds notes, call outcomes, and pipeline stages that no data feed should overwrite - updates should never touch user-created data, and tags should be added rather than replaced.

The mechanics differ by destination: importing leads into GoHighLevel without duplicates and getting local leads into Close CRM each have their own identifier and tagging quirks. If you'd rather keep the working copy outside a CRM until it's qualified, a Google Sheets destination gives you a filterable staging layer, and a scheduled run can refresh it daily, weekly, or monthly.

The legal part: CAN-SPAM, GDPR, and scraped business emails

This isn't legal advice, and no tool - ours included - makes your outreach lawful. A few facts worth carrying as industry background, current as of 2026:

• CAN-SPAM (US). The FTC requires accurate header and subject information, a valid physical postal address, a working opt-out mechanism, and that opt-outs are honoured within 10 business days. It applies to commercial email whether or not you had a prior relationship.
• GDPR (EU/UK). A named individual's work address is personal data, so you need a lawful basis and you owe notice. Generic role addresses at a company are treated more permissively than named ones, but they aren't exempt from the regulation.
• Sole traders are treated as individuals. UK ICO guidance treats sole traders and unincorporated partnerships as individual subscribers under PECR rather than corporate ones - which describes a large share of any local-business list.
• Scraping terms still bind you. An address being publicly visible doesn't grant permission to collect it in bulk, and many directories and registries restrict commercial or automated use in their terms.

Your counsel, your suppression list, and your sending hygiene are what determine whether a campaign is lawful. A data source is an input, not a defence.

The short version

For a named person at a company: check what's already published, infer the pattern from one confirmed address, verify every permutation before sending, and reach for a finder tool when the domain is big enough to be well covered.

For local businesses: website contact page and footer first, then the pages nobody reads - privacy policy, terms, booking flows - then the Facebook About section, then directory and chamber profiles. Expect free-mail and role addresses to dominate, expect several valid addresses per business, and expect a real share of the list to publish nothing but a form.

Then finish the job. Verify by SMTP, route by status, and import on a stable business identifier so next month's run updates rather than duplicates. If you'd rather test the coverage on your own niche and cities than take anyone's word for it, the free plan is 100 fully verified leads - run it and count the safe addresses yourself. Start free.