Before a sequence, a subject line, or a follow up plan matters at all, you need the right email address attached to the right person. Here is how to get it without paying for a data provider you do not need yet.
A list of fifty good prospects with guessed email addresses is worse than a list of twenty verified ones. Every bounce chips away at your sender reputation, and a domain with a high bounce rate gets throttled by Gmail and Outlook long before anyone reads your pitch. Verifying the address is the first step, not an optional extra.
Most teams discover this after their first campaign: opens look fine on paper, but replies never show up because half the messages never reached a real inbox. Fixing list quality is cheaper than buying a new domain and warming it up again.
Most companies use one email format across the whole team: first.last@, firstinitiallast@, or first@. Find one confirmed address on a team page, press release, or old job listing, then apply the same pattern to the name you actually want to reach.
Quick check: search "@companydomain.com" on Google or LinkedIn. Even one public address is enough to reverse engineer the format for the rest of the team.
LinkedIn confirms the name, current title, and company. Combine that with a free pattern lookup tool to guess the format, then verify before sending anything. This works well for mid-size companies where the about page is thin but employees are listed.
Smaller companies often list a direct contact email for press or partnerships on their about page. It rarely belongs to the exact person you want, but it confirms the domain's format instantly.
Several free extensions surface a likely email the moment you open a LinkedIn profile or company site, pulling from public records and pattern matching in the background. Useful for one-off lookups, slower for building a list of more than a handful of contacts.
The fastest option once you are sourcing leads regularly. Instead of checking a name at a time, you search by role, industry, or company size and get a list of already-verified contacts back, ready to drop straight into a sequence. This is the shortcut used in the video above, pulling from lemlist's own database of over 650 million contacts.
If you are going to be prospecting more than a handful of people a week, skip the manual lookups. lemlist's free account includes access to its B2B database, so you can search and export verified emails without piecing together a workflow from three different tools.
Try the free B2B databaseWhichever method you use to find an address, verify it before it goes into a live sequence. A single verification check catches typos, dead domains, and catch-all addresses that will bounce and drag your sender score down. This step takes seconds and saves the reputation of a domain you will need for months.
| Method | Speed | Best for |
|---|---|---|
| Company email pattern | Fast for 1–5 lookups | Targeting a few specific people at one company |
| LinkedIn + pattern checker | Medium | Mid-size companies with thin websites but active staff profiles |
| Press / about page | Fast | Confirming the domain format, not finding a specific person |
| Browser extension | Fast per profile | One-off lookups while browsing LinkedIn or company sites |
| Built-in B2B database | Fastest at volume | Building full lists by role, industry, or company size |
Verification tools check an address in three stages: the syntax is valid, the domain has live mail servers (MX records), and the specific mailbox responds during an SMTP handshake, all without an email ever being delivered. Free tiers of most verifiers cover a few hundred checks a month, which is plenty while your lists are small.
Three result types come back from a check, and each needs a different decision:
Reputable ones are, but check what permissions they request. An extension that only reads the page you are viewing is normal; one that asks for access to all browsing data deserves a second look. Prefer tools with a clear privacy policy and avoid anything that asks for your own inbox credentials.
Aim to stay under 2 percent. Above 5 percent, providers like Gmail start treating the sending domain as suspicious, and sustained high bounce rates can get a domain blocklisted. Verifying every address before it enters a sequence is how you stay in the safe zone.
A catch-all domain accepts mail to any address, real or not, so a verification tool cannot confirm whether the specific inbox exists. Send to catch-all addresses at lower volume first, and prioritize them only after you see genuine opens or replies from that domain.
Finding the address is only the input. Once the list is verified, the next problem is writing something worth opening. That is covered next in our guide to landing your first clients with personalized cold outreach.
Start a free trial and pull your first list straight from the built-in database, no separate email finder subscription required.
Start your free trial