How to Get [Almost] Anyone’s Email Address

Whether you’re an entrepreneur looking to grow your business or a salesperson across any industry, everyone knows that emailing strangers is crucial to success.

You often need to contact some combination of potential partners, clients, bloggers, publicists, or investors, and perhaps you’re already having some success in doing so. But even if you’re already cruisin’, there is always room for improvement, right?

So, with that in mind, here’s the step-by-step process I use to get almost anyone’s email address FOR FREE. Let me know in the comments, if you find this helpful.

First thing’s first: Go for the easy win

Once in a while, you strike gold, and the person you’re trying to reach has their email address listed on their company website, so searching there should always be your first step. 

Click around the homepage, contact-us, and about-us pages. Sometimes you’ll find a “Team” page, which once in a while will surprise you with gleaming nuggets of email treasure.

It’s rarely that easy, however, so if/when you strike out, your next plan of action should be to test out the “Hunter” plugin for Chrome. Hunter is not compensating me in any way, shape or form for saying this, but their service is a total game-changer! 

Once installed, click the Hunter button on any website, and it will pull up a list of email addresses tied to that domain. Sometimes it even provides the contact name, title and phone number as well. It also shows you the source of where on the web that email was listed so that you can verify accuracy. 

Another crap-shoot worth checking out for large companies is Elliott Advocacy, which provides free access to contacts for tons of companies.

If neither of those first three somewhat effortless options work, you’re going to need to roll up your sleeves and put in a little bit of work. 

But fear not; I’ve got you covered.

Most of the time, getting an email address for free is a three-step process, and in any given instance you may already have one of the first two steps completed before you even start.

Step 1: Determine the contact name

Step 2: Figure out the proper email format

Step 3:  Validate that the suspected email address actually works

Let’s dig in.

Step 1:  Determine the Contact Name

This may sound obvious, but sometimes you simply don’t know in advance who the specific person is you want to contact. Maybe you know you want to reach someone in the finance department, but you don’t know the name of the exact person.

You can usually find this info in one of a few places.

First, check those same pages on the company website that I referenced earlier—About us, Contact Us and Team. Even if they don’t have the actual emails listed, they might simply have the relevant names with titles. Locate the proper job title, and record the name or names listed.

If you’re looking for someone on the marketing team, for example, find the CMO, Marketing Director(s), Marketing Managers, etc.

If you can’t find anything on those pages, there are two more options for you to try. I typically use one tactic for smaller companies and the other for bigger organizations:

For smaller companies:

Try Googling the name of the company, then filtering your search results by news articles to find recent media coverage on them. 

Typically, local newspaper sites will run articles about grand openings or new offerings from nearby businesses and include quotes from the key staff with their names and titles.

This is great for smaller businesses that only have a few people working for them, as that’s who you can expect to be quoted in the article.

Note:  This technique can work for larger companies, as well, but as there are usually many more articles and employees to sift through, you’ll want to refine your Google search to [company name] plus [department name], before filtering by news. This will help you find an article where a person from that department was quoted.

For example, enter the below into Google Search before you filter by News:

VanBrunt Stillhouse marketing

For larger companies: 

While the above technique does still work for larger companies, Linkedin is usually a better bet. This is exact the technique I used a little while back to connect with the CEO of Zegna. Simply search for that company name and the department name together in the search field.

Filter by location if you know where to focus to narrow results for larger, more unwieldy companies. You can then read through the results until you find those employees with the most relevant titles.

Side-note on LinkedIn:

Surprise, surprise—Linkedin is in the business of making money. 

Instead of using their free service, they want you to pony up for their paid subscription “Sales Navigator” with better search specificity.

Are all those features worthwhile? If you’re in recruitment or conducting a high-volume of searches per month, then maybe. For most of us, however, I don’t feel it necessary. 

When you’re shown results of [first name] and [last initial] only, they again want you to pay for the premium subscription to see complete results. If that happens, there are some workarounds to get their full name. 

First, simply click through to their profile. Most people use their full name in their Linkedin username. In this case, I can see that Anna S. is Anna Sian. 

If that doesn’t work, Google their company name, full title, first name and last initial, and you’ll often find their full name somewhere else outside of Linkedin. 

In this case, I see Anna’s Instagram profile and her personal blog, but sometimes you’ll also/instead find articles in which they are quoted, directories they are listed, etc.

So… 

Now you’ve got the name of the person you want to reach—What’s next?

Step 2:  Email format

Once you’ve got the name of your target, you need to determine the format of their company’s email addresses. 

Name x format = email address!

First, go back to the company’s site and reactivate the Hunter plugin. While you might not have learned the email address of the exact person you were hoping to find, don’t be surprised if you find some random employee’s email. 

From that one email address, it’s pretty easy to extrapolate the format (ie, first.last@company.com). Oftentimes, Hunter will actually include the most common email format when you activate the plugin. 

Same goes for using Elliott Advocacy to determine a company’s email format. If you can find one person’s email, the odds are that other people at that company use the same email format.

If those don’t work, try googling email at [company].com or email @[company].com. Often this will return results of news articles or lists where some random employee has their email address included. 

If that doesn’t work try press at [company].com, media at [company].com, pr at [company].com or contact at company.com. 

This works because usually the most accessible members of a company are their press/PR contacts. Most companies want to make it as easy as possible for a member of the media to reach them for coverage. Who doesn’t want free press, right? If no one else at the company has an accessible email address, this could be the one lone wolf you find.

Remember, you just need someone’s email address at your target company; not necessarily your target. Then replicate that same format with your contact.

Ok… that still hasn’t worked. Now what? 

Guess!

Guess?! After all of that, Brian, you’re telling me to guess?!

Sounds terrible, I know; but it isn’t. Most companies have one default email format that holds true for all employees.

The most common for large companies are first.last@company.com or FLast@company.com, and for smaller businesses, it’s often just first@company.com.

If I had to wager a guess, those three options listed above probably encompass 75% of businesses. For the other 25%, you can try the following (in no particular order):

last.first@company.com, LFirst@company.com, first_last@company.com, F.Last@company.com, L.First@company.com, last_first@company.com, FirstL@company.com, First.L@company.com… I could go on, but you get the idea.

The full list above should get you close to 90% of the email addresses you need. Some challenging ones include middle initials, at which point, I sometimes give up. Procter & Gamble, for example used to use first.m.last@pg.com. If you’ve got time to kill, and you are certain the above format is actually correct, you could, in theory test this out 26 times with each letter in the middle initial spot to find the winner.

Assuming you had the time and inclination to do the above, is it possible to “test” this out without having to actually send an email and wait for a bounceback?

Yes!

Step 3:  Validate the suspected email address actually works

Before you fire off an email to an address you think is correct, you might as well test it out first. This test doesn’t always work, but it often does and is worth the few seconds of added effort.

Head over to ValidateEmailAddress.org, paste the email into the search box, and the site will ping the address to see if it’s valid.

You’ll either get 1 of 2 responses back: “valid” or “not valid”, but no matter which response you get, you’ll want to test a little further to ensure accuracy. Sometimes this works perfectly, but in certain situations that depend on what email server your target is using, you may get faulty data.

Let’s quickly dig into the 4x scenarios and how to handle them:

Scenario 1: You successfully prove the email address is valid

You pop in your target email address, and the indicator turns green. Valid!

Does this mean you’re good-to-go? Maybe. 

How can you confirm? Test an email address you know to be wrong, and re-run the test:

hello@pourmyparty.com returns a valid response. Test out heeeeeeeelo@pourmyparty.com to confirm. In this case, it comes up as “not valid”, and you know that your target hello@pourmyparty.com works. You’re now ready to email your prospect.

This is the ideal situation, of course. But unfortunately, it isn’t always that easy.

Scenario 2:  A false positive

Sometimes you’ll pop in an email address, and it will show up as valid, even when it isn’t. How can you test this? The same as above—test an email that you know to be wrong and re-run the test.

If the wrong email address is also “valid”, your results are inconclusive. This means that your prospect’s email may work and it may not. The only way now to know for sure is to send your email and see if you get a bounceback.

Scenario 3:  You prove the email address is not valid

You pop in your target email address, and the indicator turns red. Womp, womp.

Then, following the inverse of the tactic explained above, pop in an email you know to be correct, and run the test again. If the correct email shows up green and valid, then it’s your specific email that’s wrong.

What next? Here’s where you can try to guess which, if any of the formats we already discussed actually works (last.first@company.com, LFirst@company.com, first_last@company.com, etc).

Hopefully after enough trial-and-error, you’ll find the winner, and you’re ready to email Ms Prospect.

But what if none of them work? Does that mean you’re SOL?

Not so fast.

Scenario 4: A false negative

Sometimes your email shows up as not valid, but due to the prospect’s email server all responses show up as “not valid”. 

The question then becomes, “Do I have the wrong email address, or am I just getting a false negative?”

As with the false positive, unfortunately the only thing you can do in this case is to send off your email and keep your eye out for a bounceback.

So, that begs the question:

Why bother validating the email first?

Is this step really necessary? I say that it is worth the few minutes it may take for the following reasons:

Reason 1:  Proof that you’ve got the right email

It’s just helpful to know before you start emailing that you’re sending them to the right place. You’ll know that if you’re not getting a response, you’re either getting ignored (most-likely) or that your email ended up in Spam (possible).

Reason 2:  Proof that you’ve got the wrong email

If you know that your suspect email is wrong and you can’t figure out the right one, perhaps it best to either try the generic email address on the site (hello@company.com, info@company.com, etc), or you may need to… pick up the phone. (Spooky!)

Reason 3:  Easily test and experiment

If you’re not sure of the proper format, and you test here until you find the right one, it’s a heck of a lot faster than sending off 26 copy-and-pasted emails until you find one that works.

Reason 4:  Verify all of the emails for a group message

Many times instead of sending a cold-email to one person, I’ll send to a group of 3 or 4 prospects at the same company together. (Maybe the marketing manager, marketing director, and marketing coordinator, for example.)

If you aren’t sure in advance that all of the emails work, it’s possible that some will work and some will bounce. In that instance, you’ll have started an annoying email thread with both you and your prospects getting bouncebacks at every reply-all.

Avoid this by testing in advance. Usually, when I am getting false positives or false negatives, I nix the group emails altogether and just send them out individually to avoid the above.

Conclusion:  Knowledge is power

And there you have it—How to get almost anyone’s email address for free. These steps may sound complex, but once you get the hang of it, you can systematically work through the process quickly. I can usually run through the whole decision-tree to get almost anyone’s email address in about 5 minutes.

Cold emails are a part of the business for many entrepreneurs and salespeople. Sharpening your skills will help you immensely and save you a ton of time.

Hopefully this in-depth guide will turn you into a cold email expert.

In a future post, I’ll dig into how best to craft a cold-email and how to use email templates to your advantage.

With that said, being a cold-email expert is far from the only skill you need to be successful in business. Before you dig into the techniques listed here, you must first get organized. Quick-start that process with my “One Calendar” strategy.

Any questions? Leave them in the comments.