How to Find Anyone's Email Address for Cold Outreach (2026)
October 12, 2026 · 6 min read · by ColdCrow
The hardest part of cold email isn't writing — it's finding the address. Most companies hide their emails behind forms and gatekeeping, and paid tools are expensive. Here's the free-and-cheap stack that works in 2026.
Method 1: The pattern trick (fastest, free)
Most companies use a consistent email pattern. Find one public address on the domain (from a blog post, GitHub commit, press release, or conference page) and you can often guess the rest:
firstname@company.comfirstname.lastname@company.comf.lastname@company.comfirstname@team.company.com
Always verify before sending. A wrong guess bounces and hurts your sender reputation. Free verification: check the MX record exists, then send a test to a mailbox you control or use a verification tool's free tier.
Method 2: Public sources most people skip
- GitHub: committers' emails are often public in commit history or profile settings
- Press releases: PR contacts are real people expecting outreach
- Conference speaker pages: speakers are approachable and relevant
- Podcast guest pages: guests explicitly want to be found
- Company blog authors: the byline email is frequently clickable
Method 3: The social proof shortcut
Search LinkedIn for the person's name plus the company domain in a phrase like "@company.com". People paste their addresses in comments, threads, and posts all the time. Same for X/Twitter bios — many B2B operators keep a work address there for business inquiries.
Method 4: Free tiers of paid tools
Email finder tools (Hunter, Apollo, Snov, Findymail) all have free tiers: 25-50 verified credits a month, no card required. Use them for your highest-value prospects — the ones where a wrong guess costs a relationship — and use the pattern method for the rest.
When to use role addresses instead
support@, hello@, andsales@ addresses have lower reply rates — but they also never bounce, and they often route to a human whose job is to respond. For tool companies evaluating AI products (like most of the prospects in your ICP), a well-written email tosupport@ gets forwarded to product or partnerships surprisingly often.
The verification rule
Every address you find — guessed or sourced — needs one check: does the domain have a valid MX record? No MX, no send. After that, keep your bounce rate under 3% by never emailing addresses you're not confident about.
Once you have the address, the writing should be the fastest part. ColdCrow turns a prospect description into a personalized, deliverability-scored draft in seconds — so your time goes into research, not the blank page.