How to find business emails that actually reach someone.

Where business email addresses are published

Most companies publish at least one address because they want to be contacted. The work is knowing where to look, in roughly this order of yield:

Why WHOIS rarely helps now

Domain registration lookups used to expose the owner's email. Since ICANN's Registration Data Policy took effect on August 21, 2025, registries and registrars must redact personal data in public registration records where applicable law requires it, and many redact it anyway. ICANN also made RDAP the definitive lookup service in place of WHOIS for generic top-level domains. Expect a redaction notice or a privacy-proxy address, not a person.

If you are building a list of local businesses, the website is where nearly all the email yield is. Plumbers, clinics and agencies rarely publish anything elsewhere.

Common corporate email patterns and how to guess one

Companies pick one format and apply it to everyone. Once you know it, you can build the address of anyone whose name you have. Using a fictional person, Jane Doe at example.com:

Small businesses with a handful of staff tend to use just the first name. Larger companies usually need a format that avoids collisions, like first.last or flast. Do not guess blindly across all seven:

1. Find one confirmed address at the domain: a press contact, a team page, an email signature in a public post.
2. Infer the pattern from it. If press@ is the only one, it tells you nothing; you need a personal address.
3. Apply it to your target's name, watching for hyphenated names, nicknames (Bob vs Robert) and accents.
4. Verify the result before it goes into a campaign.

How to verify a business email before you send

Verification answers one question: will this address accept mail? It runs in three layers, from cheap to fragile.

1. Syntax and domain

Check the address is well formed and the domain exists. This catches typos and dead companies.

2. MX lookup

A domain receives email only if it publishes MX (mail exchanger) records. You can check from a terminal with dig MX example.com or nslookup -type=mx example.com. No MX records usually means no mail service for that domain, so every address there will fail. MX records also tell you the provider (Google Workspace, Microsoft 365 or a host), which is handy context.

3. SMTP mailbox check

A verifier connects to the mail server and starts a delivery without sending a message, to see whether the server accepts or rejects that mailbox. Useful, but with real caveats:

• Catch-all domains accept every address, real or not, so the check cannot tell jane.doe@ from xyz@. Verifiers report these as "catch-all" or "unknown". Treat them as unconfirmed.
• Greylisting and rate limits make some servers answer "try later", which shows up as unknown.
• Large providers may accept at connection time and bounce later, so a pass is a strong signal, not a guarantee.
• Do not probe from your own sending domain. Running many SMTP checks from your mail server can hurt its reputation. Use a verification service.

Generic or personal address: which is better?

Neither is always better. It depends on company size and on what you are asking for.

For a three-person HVAC shop, info@ often is the owner. For a 200-person firm, you want the head of the relevant function, and that is where a named contact and pattern guessing pay off.

Types of email finder and verifier tools

You can do all of this by hand for a few dozen leads. Beyond that, tools fall into four groups:

• Domain search tools: enter a company domain and get the addresses found publicly for it, plus the likely pattern.
• Email finders: enter a name and a domain, get the most likely address and a confidence level.
• Email verifiers: upload a list and get valid, invalid, catch-all or unknown for each row. Run every cold list through one.
• Lead list builders: start from a type of company and a location and return companies with contacts attached. See our roundup of lead generation tools.

When choosing, check where the data comes from, whether you pay for unknown results, and whether the vendor lets you export freely.

Deliverability basics before your first send

A verified address is worthless if your email lands in spam. The minimum setup:

• Authenticate your domain. Google's email sender guidelines require SPF or DKIM for everyone sending to Gmail, and SPF, DKIM and DMARC for senders of 5,000 or more messages a day.
• Watch your spam rate. The same guidelines ask senders to keep the rate reported in Postmaster Tools below 0.3%, and recommend staying under 0.1%.
• Keep bounces low. That is what verification is for. High bounce rates tell mailbox providers you bought or guessed a list.
• Send in small batches and write to each segment specifically. Volume with identical copy is how cold email gets filtered.
• Consider a separate sending domain for cold outreach, so problems do not affect your main domain's mail.

CAN-SPAM essentials for cold B2B email

The CAN-SPAM Act does not require consent before you email someone, but it sets rules for every commercial message, and the FTC is explicit that it makes no exception for business-to-business email. From the FTC's compliance guide:

• No false or misleading headers. From, To, Reply-To and routing information must be accurate and identify you.
• No deceptive subject lines. The subject has to reflect the content.
• Identify the message as an ad, clearly and conspicuously.
• Include a valid physical postal address: a street address, a USPS-registered P.O. box, or a registered private mailbox.
• Tell recipients how to opt out, and keep that mechanism working for at least 30 days after you send.
• Honor opt-outs within 10 business days. You cannot charge a fee or ask for more than an email address to process one.
• Monitor anyone sending for you. Hiring an agency does not move your legal responsibility.

Penalties are per email: the FTC guide lists up to $53,088 for each separate email in violation. This is a summary, not legal advice; if you email people in other countries, their laws also apply.

Getting business emails with Reachant

Reachant starts from the other end: you pick a business category and a city, it finds the companies through the official Google Places API, then visits each company website and collects the public email address it finds there, along with phone, WhatsApp and social links. For US companies it also looks up a decision-maker's name and title. The email arrives as one column in the lead record, which you can export to CSV.

Two things to know. Reachant does not verify those emails, so run the export through a verifier before any cold campaign. And a company with no website, or a site with only a contact form, will have an empty email field. The Google Maps scraper page lists every field and its source, and our B2B lead generation guide covers what to do with the list once you have it.

Frequently asked questions

Keep reading