How to Find Emails for Cold Outreach (Without Buying Lists)

Every founder asks the same question after their first failed campaign: where do I get emails? The wrong answer is buying a list — rented contacts are stale, unverified, and a one-way ticket to the spam folder. The right answer is finding the person yourself, in the places they actually publish their address.

1. Start from the company website

Almost every B2B company exposes at least one email publicly. Check, in order: the contact page, the about/team page, and the press page. Many sites list hello@, team@, or founders@ directly. If you only see a form, view the page source and search for "@domain.com" — a surprising number of forms leak a mailto: in the markup.

2. Company databases, free tier

Crunchbase and LinkedIn both let you search companies by industry, headcount, and location without paying. You're not looking for the email — you're looking for the person and their exact title. The databases give you the "who"; the pattern step below gives you the "where".

3. The email pattern engine

Most companies use one of a handful of patterns: first@, first.last@, or firstlast@. Find one confirmed address for the domain (a press release, a GitHub commit, a podcast mention) and the pattern usually generalizes to the whole team. Never send on a guess alone — always verify first.

4. Social proof sources

Engineers leak emails in public places: GitHub commit messages and profiles, npm package metadata, conference talk slides, and domain WHOIS. For a technical audience, a GitHub profile email is often warmer than a guessed company address — it was published by the person themselves.

5. The verification step

Guessed addresses that bounce destroy your sender reputation. Before sending, verify: check the domain's MX records exist, test the address with a free verifier (they check syntax, domain, and catch-all status), and confirm the recipient's role. One bounced campaign can silence a fresh mailbox for weeks.

6. What to do when you can't find one

If a person has no findable address, they're either unreachable by email or not worth reaching. Skip them. Your time is better spent finding 30 people with verifiable addresses than collecting 300 guesses that bounce.