How to find emails for cold emailing (7 methods, free and paid)

To find emails for cold emailing, start where the business publishes its own address: the contact page, footer or legal notice of its website. For a named person at a larger company, use an email finder such as Hunter or Apollo, or work out the company's address pattern and verify it. Whatever the source, check every address before you send.

This guide covers seven ways to find email addresses for cold outreach, what each one costs, and which fits the kind of prospect you are after. Most of them are free. The paid ones start to earn their price when your list is too long to build by hand.

Which method fits your prospect

The right method depends on who you are emailing. A dentist with one shared inbox and a VP at a 500-person company need different approaches.

What makes an email address worth sending to

A cold email address is one you found yourself, for a person or business that has not heard from you before. There are two kinds. A role address is a shared inbox such as info@, hello@ or office@. A personal address belongs to one named person, such as jane@ or jane.smith@.

For a small local business, the role address is often the best one you can get, because the owner or the person sitting next to the owner reads it. At a larger company a role address lands in a queue, and you need the named person instead.

Before any address goes on your list, check three things:

• It exists. The domain accepts mail and the mailbox is real.
• It reaches someone who can say yes to what you sell.
• You have a lawful reason to email it. The legal section below covers the basics for the US and the EU.

Method 1: Read the business's own website

The business website is the most reliable source, because the business chose to publish the address there. It costs nothing and it works for almost any company that has a site.

1. Scroll to the footer of the home page. Many small businesses put the address there.
2. Open the Contact and About pages. If the menu does not show them, try /contact, /about or /team after the domain.
3. Check the legal notice. German sites carry an Impressum, and section 5 of Germany's Digital Services Act (DDG) requires it to include an email address.
4. If the page only shows a contact form, view the page source and search for mailto: or @. The address is sometimes in the code but not on the page.

Expect a few minutes per business. That is fine for 20 prospects and painful for 500.

Method 2: Search Google for the address

Search engines index addresses that appear in PDFs, press releases, directory listings and old pages the site no longer links to. Put the domain in quotes so Google looks for that exact string.

site:example.com "@example.com"
      "@example.com" contact
      "Jane Smith" "example.com" email

The first query looks only inside the company's own site. The second finds the address anywhere on the web. The third looks for one named person. This method is free, and it is hit or miss: a business that never published its address anywhere will return nothing.

Method 3: Start from Google Maps for local businesses

Google Maps is the best free directory of local businesses, but a listing has no email field. It shows a phone number, an address, opening hours and a website link. So the route is always the same: listing, then website, then email.

By hand, that means opening each listing, clicking through to the site and repeating Method 1. In bulk, a Google Maps tool does the same thing for a whole niche and city at once. Our guide to finding business emails from Google Maps compares four ways to do it.

Method 4: Use an email finder for named people

An email finder is a tool that takes a company domain, or a person's name plus a domain, and returns addresses it has found on the public web along with the pattern the company uses. Hunter, Apollo and Snov.io are the best known.

• Hunter has a Domain Search that lists the addresses it has seen for a domain, and an Email Finder for one named person. Its pricing page lists a free plan with 50 credits a month at the time of writing.
• Apollo and Snov.io are contact databases you search by job title, company size and industry, then export.

These tools are built around named employees at companies. They are the right choice when you need the head of marketing at a software firm. They are a poor fit for a two-person plumbing business whose only address is info@ on its own contact page, which is where Methods 1 and 3 do better.

Method 5: Work out the pattern, then verify

Most companies use one address pattern for everyone. If you know the pattern and the person's name, you can build the address yourself.

1. Find one real address at the company. Press releases, author bylines and job adverts are good places to look.
2. Read the pattern from it. The common ones are first@, first.last@, flast@ and firstl@.
3. Apply the pattern to your prospect's name.
4. Verify the result before you send. A guess is only a guess until a mail server confirms it.

Guessing without verifying is how lists fill up with bounces. Our guide on how to verify an email address before sending walks through the free checks.

Method 6: Check LinkedIn and social profiles

A LinkedIn profile has a Contact info link under the person's name. It shows an email only if the member chose to display one, and often only to their connections. It is worth a look once you are connected.

For local businesses, Facebook is more useful. The About section of a business page often lists an email address, and some businesses keep their Facebook page more up to date than their website.

Method 7: Ask

Call the number on the listing and ask who handles the thing you sell and what the best address for them is. Or use the contact form to ask the same question in two lines. It feels slow, but you get a named person and an address they agreed to give you, which no tool can match.

The seven methods compared

Where LocalLeads fits, and where it does not

LocalLeads is the tool we build, so read this part with that in mind. It does Methods 1 and 3 in bulk for local businesses. You type a niche and a city. It finds the businesses on Google Maps, reads each business's own website for an email and a phone number, and checks that the email's domain has a mail server (an MX record).

It also ranks each business from 0 to 100 by how likely it is to buy what you sell, whether that is websites, SEO, ads or social, and lists the reasons on the row. That tells you which addresses to write to first.

Here is what it does not do:

• It does not do mailbox-level (SMTP) verification. The MX check tells you the domain can receive mail. It does not tell you that this exact mailbox exists.
• It does not guarantee deliverability.
• It does not find personal emails of named individuals at large companies. Use an email finder for that.
• It does not write or send emails.

LocalLeads needs a free account, which includes 100 leads every month with no card. One credit is one delivered lead, and the contact lookup is part of that credit. Pro is €4.99 a month for 500 credits, or €48 a year with 6,000 credits up front. Business is €19.99 a month for 2,500 credits, or €192 a year with 30,000 up front. You can export to CSV or Google Sheets, pull the list through the API, or work with it from Claude or Cursor through MCP.

Verify before you send

Finding an address is half the job. Addresses go stale when people leave and domains lapse, and every bounce counts against the domain you send from.

Gmail also watches how recipients react. Google's email sender guidelines tell senders to keep the spam rate reported in Postmaster Tools below 0.10% and to avoid ever reaching 0.30%. A list full of wrong or irrelevant addresses pushes you toward that line.

So before a large send, run the list through a dedicated verifier such as ZeroBounce, NeverBounce or Bouncer, whichever tool found the addresses. That includes lists from LocalLeads.

Is it legal to cold email addresses you found?

This is general information, not legal advice. Rules differ by country, so check the ones that apply to you and to the people you email.

• United States. The CAN-SPAM Act allows unsolicited commercial email if you follow its rules. The FTC's compliance guide says the law makes no exception for business-to-business email. You need accurate sender details, an honest subject line, a postal address and a working opt-out that you honor within 10 business days.
• European Union. Recital 47 of the GDPR says processing personal data for direct marketing may be regarded as a legitimate interest. That is the basis most B2B senders rely on when they write to role addresses about something relevant to the business. National e-privacy laws add their own rules and some are stricter, so check the country you are sending to.

For how the data is collected in the first place, see Is Google Maps scraping legal?

Build your first list

If your prospects are local businesses, you can try this on a real niche in a couple of minutes. The link below creates a free account and then runs the search, so you see ranked businesses with the contact details their websites publish.

Find dentists in Austin with emails

LocalLeads by PostOrbit, built by EtherLabz.