How to Find Someone's Email Address (B2B, 2026)

If you run cold outreach, partnerships, or recruiting, you already know the friction. You have a name. You have a company. You need their work email, and you need it to actually deliver.

This guide is for B2B work email: [email protected], on a company-controlled domain. It covers the five methods we recommend in 2026, ordered from manual techniques you can run yourself up to a one-step tool, then the benchmark and campaign data on which ones produce emails that actually deliver.

TL;DR

The five methods, from most manual to most automated:

1. Google search operators
2. LinkedIn About and Contact Info
3. Industry events, press, and podcast guest pages
4. Direct ask through company chat, social DM, or generic inbox
5. A B2B email finder tool that combines lookup with real-time verification

Note: A finder that returns [email protected] without verifying the mailbox exists is generating bounce risk, not leads. The benchmark data at the bottom of this post shows how much risk.

Method 1: Google search operators

Targeted operator queries still surface work emails that no database has indexed. The patterns that work in 2026:

• "firstname lastname" "@companydomain.com" to find a published address in the wild.
• site:companydomain.com "firstname lastname" to find the person on their employer's own pages, which often link to contact methods.
• site:linkedin.com/in "firstname lastname" companyname to find the LinkedIn profile, then run Method 2.
• "firstname lastname" filetype:pdf companyname to find conference papers, press releases, and other documents that often expose work emails.

Operator searches work best when you have a relatively unique name or a small company. For common names at large enterprises, the noise outweighs the signal and Method 2 is a better starting point.

Google also throttles aggressively. Manual operator searches stop returning results after a few dozen queries from the same IP, prompting captcha walls and temporary blocks. The technique is not built to scale. If you have hundreds or thousands of name-and-domain rows to resolve, skip ahead to Method 5; a finder API can process 10,000 inputs in one call without tripping any of these limits.

Method 2: LinkedIn About and Contact Info

If the person has a LinkedIn profile, the About section often lists a work email directly. The Contact Info panel (visible to first-degree connections) reliably exposes it. For decision makers, this is usually enough to confirm the company domain, after which Method 5 takes over.

LinkedIn is also the cheapest way to confirm someone is still at the company you think they work at. Cached database tools (Apollo, ZoomInfo) lag job changes by weeks or months. LinkedIn updates the day the new role is announced. If your finder returns nothing for a prospect you expected to find, check LinkedIn first; the most common cause is that the person changed jobs and your source list is stale.

Method 3: Industry events, press, and podcasts

If your prospect spoke at, sponsored, or attended an industry event, the event organiser's site frequently lists work emails. Search the event domain plus the prospect's name. Press releases, board appointments, and award announcements are the equivalent surface for senior executives.

Podcast guest appearances are a high-hit-rate single source. Hosts publish show notes that almost always include the guest's contact details, sometimes as a "follow this guest" block. Search the podcast domain and the prospect's name; the show notes page is the highest-yielding single document for any prospect with a podcast appearance in the last two years.

Method 4: Direct ask through chat, social, or generic inbox

When the database tools and the manual surfaces fail, the fallback is to ask.

• Site chatbots. Many B2B sites ship customer-service chatbots that will, if asked specifically, route a query to the named person. Slow, not scalable, but works on awkward cases where the prospect is real but every database has them at a previous employer.
• Social DM. A polite LinkedIn or X DM asking for the right way to get in touch is below the threshold of feeling like outbound and gets responses from people who would never reply to a cold email.
• Generic inboxes. info@, contact@, hello@. Lower hit rate but functional for smaller companies where the generic inbox is read by someone close to the decision maker.

Method 5: Use a B2B email finder tool

If you would rather skip the manual work above, a one-step finder tool does most of it in seconds. Here is what to expect.

A B2B email finder takes three inputs:

• First name
• Last name
• Company domain (e.g. acmecorp.com)

It returns one of two things:

• A verified work email. The tool probes the mailbox at the company mail server and confirms it accepts mail. If the domain has email security in front of it (a catch-all or greylisted mail server, or a SEG like Mimecast), the mailbox can still be validated using additional real-time verification methods. If an address is returned, it should deliver.
• Nothing. The tool could not find a real mailbox for this person at this domain, or it found a likely address but could not verify deliverability. Input quality matters too: a stale name, a domain that has moved providers, or a wrongly-mapped employer will all surface here as a no-result.

The tools worth using do not return guesses. Every email returned is pre-validated.

If a finder returns a best guess without verifying it, you have two options downstream: pray it does not bounce, or pay a second tool to validate it. The one-step model collapses that into a single call: you pay once, the finder only returns what is already verified, and there is no separate validation step to chase.

It is tempting to use a finder that returns its best guess and lets the user decide. The cost of doing that is sender reputation. One bounce in a hundred is fine. One in twenty starts hurting deliverability across the rest of your list. One in ten gets you flagged.

If the tool cannot find a confirmed mailbox, returning a plausible guess does not help. It just shifts the cost from a missing record to a damaged sender domain. A good finder will return nothing on a meaningful share of inputs rather than return guesses on most of them.

Tools that implement this one-step model include OrbiSearch. You can run single lookups interactively in the OrbiSearch dashboard, upload a CSV for batched runs, or call the find-email API directly.

The catch: a found email is not always a deliverable email

The bulk of email-finding tools report a find rate that conflates two things: the rate at which they return an address, and the rate at which that address actually accepts mail. These are not the same number.

A few patterns produce the gap:

• Catch-all domains. A company can configure its mail server to accept any address ending in its domain, even ones that do not exist. Hit [email protected] and the server returns "accepted". Most finder tools correctly detect that a domain is catch-all; the problem is that few can then probe behind it to confirm whether a specific mailbox actually exists, so they either return everything (high bounces) or flag the address as risky and discard it (lost prospects). According to DeBounce's research, 10 to 30 percent of B2B emails sit on catch-all domains, and the share trends higher on lists where most companies sit behind Microsoft 365, Google Workspace, or enterprise mail security gateways.
• Stale databases. Apollo, ZoomInfo, and similar platforms serve emails from cached databases. A person who left their job six months ago still has a record. The email still exists in the database. It does not exist on the company mail server. The find rate looks fine. The bounce rate does not.
• Pattern guessing without verification. Some tools generate likely email patterns (first.last@, flast@, etc.) and return the most common one for the company. If the pattern does not match the actual mailbox, the address goes out and bounces.

The metric that matters is not find rate. It is verified find rate: the proportion of inputs that produce an address you can ship to without burning sender reputation.

The proof: three datasets

Three independent data points back up the workflow above. Two come from customer-run benchmarks. One is our own validator accuracy benchmark.

IntellyClick: 2,224-email Apollo benchmark

Aleix Torres at IntellyClick took a 2,224-email list pulled from Apollo and ran it through three verification services. He reported the results on our Icypeas comparison page:

Out of a batch from Apollo with 2,224 emails: MailTester Ninja 48.3% valid, Icypeas 56.0% valid, OrbiSearch 68.3% valid.

On the same underlying Apollo list, OrbiSearch returned a verified-deliverable share roughly 12 percentage points above Icypeas and 20 points above MailTester Ninja. The gap is the catch-all and SEG-protected segment. Other validators flag those addresses as risky and effectively force them off your list. OrbiSearch verifies them where possible and only discards what genuinely fails.

If you take Apollo's stated coverage at face value, the IntellyClick benchmark shows that roughly a third of what Apollo returns is no longer deliverable by the time you go to use it. That third is the gap between database find rate and verified find rate.

CodeDistrict: 100,000-row find rate test

Asif Ali at CodeDistrict ran a larger-scale find test. He fed OrbiSearch a 100,000-row prospect dataset across 34 email patterns. He reported on our Icypeas comparison page:

I ran a test on the data and achieved an email find rate of approximately 60%, which is very good.

He also noted the relevant caveat: no tool consistently provides 80 to 100 percent valid emails on large datasets because the underlying lead-source quality is the binding constraint. That is honest, and it is the point. A 60 percent find rate on a real-world 100K dataset is a verified find rate, not a database lookup rate. The 40 percent that did not return a result includes records where the person has left the company, the domain has moved providers, or the mailbox genuinely does not exist. None of those records would have been useful even if we had returned a guess.

For context, OrbiSearch's headline find rate on a representative set of B2B emails known to exist is around 75 percent. The 60 percent CodeDistrict observed reflects what happens when you run that engine against a real production list with its share of stale records.

538-email hard-bounce benchmark

The validator accuracy that underpins the finder comes from a 538-email hard-bounce dataset we built from real cold outreach campaigns. The list contains emails that slipped past multiple validators stacked in Clay and bounced when sent. The right answer for every address on this list is "invalid". Anything a validator flags as safe is a false positive.

Results across four validators:

Validator	Caught	False positive rate
OrbiSearch	96.3%	3.7%
BounceBan	94.6%	5.4%
Icypeas	78.1%	21.9%
Enrichley	67.1%	32.9%

OrbiSearch caught the most hard bounces and had the lowest false positive rate. A low false positive rate matters because a false positive is an address you would have shipped to and would have bounced. The validator accuracy is what lets the finder return only verified addresses without losing the catch-all share to caution.

Detailed methodology and the underlying analysis is in our BounceBan vs ZeroBounce post.

Field validation: Danby Marketing cold campaign

The benchmarks above are list-level. What happens in a live campaign?

Joseph Danby at Danby Marketing Services ran cold campaigns using two contact lists: one built and validated by OrbiSearch, one by Apollo. Same audience, same sequence, same cadence. He posted the result publicly on LinkedIn:

The headline numbers from his post:

• OrbiSearch reply rate: 3.58 percent. Apollo: 2.05 percent. 75 percent more replies.
• OrbiSearch bounce rate: 1.29 percent. Apollo: 1.5 percent. 14 percent fewer bounces.

Reply rate is the number to internalise. It compounds. More replies means more meetings booked per thousand emails sent, and more pipeline downstream. The bounce rate matters because it protects the sender reputation that lets the reply rate keep working campaign after campaign.

For developers: find emails programmatically

If you are building a tool, an enrichment pipeline, or an outbound automation, the OrbiSearch finder is available as an API. The verification step is bundled. You do not need to call a separate verifier afterwards.

Request shape:

POST /v1/find-email
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

{
  "first_name": "Jane",
  "last_name": "Smith",
  "domain": "acmecorp.com"
}

Response shape:

{
  "email": "[email protected]",
  "status": "valid",
  "confidence": "high"
}

If no verified mailbox is found, the response returns a status of not_found rather than a guessed address. Bulk endpoints accept arrays of inputs and return one record per input.

Full request and response schemas, rate limits, and error codes are in the API reference. For programmatic verification of an email you already have, see the verify-email endpoint.

FAQ

How do I find an email with just a name?

You cannot, reliably. A name on its own does not pin down a person, let alone a mailbox. The minimum input for a B2B finder is name plus company. If you only have a name, the next step is to identify where the person works (LinkedIn search, Google operators, company directories) before any finder can help.

Is there a free B2B email lookup?

OrbiSearch's free single-email validator and free bulk validator are usable without an account. The finder itself runs through the dashboard on a credit basis (sign-up credits are included on the free tier). For low-volume usage, the free credits are enough to cover most one-off prospecting work.

What is the difference between finding an email and validating one?

A finder takes inputs (name plus company) and returns an address. A validator takes an address and returns a verdict on whether it accepts mail. Most workflows historically chained the two: find with one tool, validate with another. OrbiSearch's finder does both in a single call, so the address it returns is already verified.

How is OrbiSearch different from Apollo and ZoomInfo?

Apollo and ZoomInfo serve from cached databases. Records age. A record that was accurate six months ago may not be deliverable today because the person has changed jobs or the company has migrated mail providers. OrbiSearch performs the lookup and verification in real time at the moment you call it. The downside is that we do not cover people whose work email cannot be verified at the moment of the call. The upside is that what we do return is current.

What email statuses does OrbiSearch return?

Three: safe (verified deliverable), risky (mixed signals, usually catch-all domains we could not fully resolve), and invalid (mailbox confirmed not to accept mail). The finder only returns addresses with status safe. The validator surfaces all three. See the verification statuses documentation for the full definition of each.