Sometimes the only thing standing between you and landing your ideal client is finding their email address.
If you want to master the art of cold emailing, this is where you begin.
Below, we’ll show you all the practical ways to find your lead’s email address, how to do it at scale (or through LinkedIn), and where to go from there.
Essentially, you can find emails manually or automatically, and we’ll cover both ways below.
If you want to find the emails of a handful of people, it might be faster to do it manually.
But if you have a spreadsheet of 100+ leads, using specific email software will be easier.
Don’t worry, though, we’ll cover both below, as well as some email tools to get you started.
Here’s what we’ll cover:
- Preparing for Outreach Before Finding Their Email
- 5 Ways to Find Someone’s Email Online For Free
- 3 Best Email Marketing Tools to Find Your Target Audience’s Email Addresses Automatically At Scale
- How to Validate an Emails Address Before Outreach
We have a lot to cover!
So, let’s just jump into it.
Table of Contents
Preparing for Outreach Before Finding Their Email
You might already know how to do this step.
But let’s cover all bases of email marketing before we jump into outreach.
Because, even if you have found someone’s email address, you should at least know in advance what you’re going to do with it. Or if you’re fully prepared before outreach.
Some of these might not apply to you, so please skip ahead.
Email marketing account warmup for outreach
You don’t want to skip this step if you’re doing cold email outreach at scale.
Email warmup refers to establishing a reputation for your email account to increase your daily email sending limit.
The daily email send limit is 500 emails per 24 hours for individual Gmail accounts.
If you think that’s a lot and only want a handful of emails to your ideal leads, feel free to skip ahead.
If not, here’s a brief overview of how this works:
- When you’re sending and receiving emails when warming up your account, Gmail wants to know if this is actual activity. So, they track open rates, clickthrough rates, reply rates, and more.
- To increase your email daily send limit, you’ll need to authenticate a few key back-end settings like DKIM, SPF records, and DMARC.
- Then, you can use email warmup tools to warm up your email inbox and prepare for outreach. This will send automated emails to and from other people and automatically click and reply for you.
We covered how to do all this and more in our email warmup guide, so be sure to check that out.
Where to find your ideal target audience
Do you already know where to look for your target audience in the first place?
If you have any point of contact like a LinkedIn profile, website (personal or company), or anything else, it’s going to be much easier to find their email address.
You can use LinkedIn’s basic version or even Sales Navigator for better prospecting.
Boolean searches are also helpful here, here’s how this works:
- Quoted search – Put your search query around quotation marks to find an exact phrase. For example, type “LinkedIn marketer” to find someone with that multi-world title.
- NOT searches – To exclude a phrase from your results, e.g., “sales NOT manager”.
- OR searches – To see results that include one or more items in a list. E.g., “sales OR marketing OR advertising”.
- AND searches – To find results that include all items in a list. E.g., “accountant AND finance AND CPA”.
PS – If you need more info on doing LinkedIn lead generation at scale, you can automate your outreach entirely with Expandi! In this case, you could set it up so that you connect with the 150+ results from above on autopilot. Check out our complete guide to LinkedIn message automation for more info on this.
Email templates
Know your lead’s email address but wondering what to actually write inside your email?
Unfortunately, there’s no easy answer for this as it will largely depend on your objective.
So, you can check out our LinkedIn cold message templates to get an overview of what this might look like.
As a bonus point, you can send a cold email first and then follow up on LinkedIn (this is called omnichannel outreach! Or use dynamic GIFs like this that automatically grab your contact’s first name or company name.
Now, let’s get back to the topic of finding email addresses.
As mentioned above, you can find someone’s email manually or automatically, let’s cover both ways below.
5 Ways to Find Someone’s Email Online For Free
Why would you do this manually?
Well, you might not want to spend money on expensive software, might be looking for emails for under ten specific key people, or this might even be faster!
1. Make an educated guess based on common patterns
Here’s a quick hack:
Most companies use the email pattern {first_name}@example.com.
So, if you know your lead’s first name, last name, and web domain, you could make an educated guess to find their email instantly!
Other common patterns might include:
- (first-name-initial)(last-name)@example.com
Then, you can use an email verification tool (more on this below) to confirm this.
Or, you can simply paste it into Gmail and you should see the profile picture or other info of the person you’re trying to reach.
Note: This will only work if your lead has a Gmail-hosted email.
Simple, right?
2. Check their LinkedIn
Sometimes, their email address will just be out in the open in their LinkedIn profile.
Just click on the Contact info button on their LinkedIn profile and you can find their website, email, and sometimes, even more info.
Though, this isn’t always the case and sometimes, they might have their email here.
So, it’s always worth double-checking.
Similarly, you can also double-check a lead’s Facebook company page, LinkedIn “About” section, and Twitter profile.
3. Use advanced Google searches
You can also simply Google your lead’s email address to reach out, as with most things.
Here’s how this works:
Running a search query under “” will tell Google to search only for that exact match (e.g., “LinkedIn template” will only show you results that contain that keyword in the title).
You can also use this hack to find your prospect’s contact info, like so:
Then, going through some of those search results, we can confirm that his email is listed publicly, just like that!
Using advanced Google search tags, we found a podcast episode the CEO of Lemlist was on, which has his email listed, as you can see below.
4. Check their Twitter history
Sometimes, people tweet their email addresses, and you can simply search historical tweets to find them.
Essentially, you can search for the word “email” from a specific account and hope they gave their contact info to someone in the past.
To do that, use the following Twitter advanced search tag: ‘@(Twitter handle) “email”’.
For example, to find the email of Buffer’s CEO, we can use the following search text: ‘from:@joelgascoigne “email”.
This shows us the following:
Now, that’s a tweet from 2015 and this might seem like you’re going out of your way to finding their email, but for times when other methods don’t work, this can save you if you’ve tried everything else.
5. Use automated guessing to find all combinations of the email
This is another last measure hack to find someone’s email.
For this, we’ll be using a free tool called Email permutator, which does all the manual work for you and figures out all possible email combinations based on:
- First name.
- Last name.
- Middle name (optional).
- Domain.
Once you enter that info, press Permutate and copy the info.
Now, what do you do with 34 emails?
You can either use an email verification tool (see below) or paste them into Gmail and use the profile picture hack we covered in step #1!
But sometimes, using email marketing tools that let you punch in a domain and find all the emails associated with those sites is easier.
So, let’s cover that too.
4 Best Email Marketing Tools to Find Your Target Audience’s Email Addresses Automatically At Scale
There are a lot of both, free and paid email marketing tools that let you find someone’s email.
Depending on the tool, you can even set up an email outreach campaign directly after.
But as far as finding contact info based on web domain is concerned, most of them should be able to get the job done.
So, here’s a quick overview, in no order:
1. Hunter.io
Who is it for: Startups, marketers, salespeople, freelancers, anyone looking to find email contact info or level up their lead generation.
Pricing:
- Free – 25 email searches per month, 50 email verifications.
- Starter – $55/mo, 500 searches per month, 1,000 verifications per month.
- Growth – $110/mo, 2,500 searches per month, 5,000 verifications per month.
- Pro – $220/mo, 10,000 searches per month, 20,000 verifications per month, premium features and support.
- Enterprise – $445/mo, 30,000 searches per month, 60,000 verifications per month, premium features, support, and more.
Best features: domain search, email finder and verifier, cold email campaigns, integrations, browser extension, API for developers, and more.
2. GetProspect
Who is it for: The email finder is useful for those who want to increase leads, boost sales and accelerate business growth, such as sales teams, business developers, recruiters and marketers.
Pricing:
- Free – 50 valid email addresses per month, 100 email verifications.
- Starter – $49/mo, 1,000 valid email addresses per month, 2,000 verifications per month, 5 phone numbers.
- Growth 5k – $99/mo, 5,000 valid email addresses per month, 10,000 verifications per month, 5 phone numbers.
- Growth 20k – $199/mo, 20,000 valid email addresses per month, 40,000 verifications per month, 5 phone numbers.
- Growth 50k – $399/mo, 50,000 valid email addresses per month, 100,000 verifications per month, 5 phone numbers.
Best features: email finder and verifier, bulk email address search, data enrichment, robust B2B database with millions of contacts (including emails), 17+ advanced search filters, browser extension, API, native integrations with popular CRMs, and more.
3. Snov.io
Who is it for: Sales teams, marketers, bigger focus on outreach campaigns.
Pricing:
- Free forever – Renewable free forever plan with 50 monthly credits and 100 drip campaign recipients to try out the tool.
- S – $33/mo, 1,000 credits, 5,000 unique recipients, CRM functionality, unlimited users.
- M – $83/mo, 5,000 credits, 10,000 unique recipients, CRM functionality, unlimited users.
- L – $158/mo 20,000 credits, 30,000 unique recipients, same as above.
- XL – $308/mo, 50,000 credits, 50,000 unique recipients, same as above.
- XXL – $615/mo, 100,000 credits, 100,000 unique recipients, same as above.
Best features: Email drip campaigns, email finder and verifier, campaign sending and tracking, prospect management, campaign analytics, and more.
4. FindThatLead
Who is it for: B2B marketers, salespeople, sales teams, growth hackers, recruiters, and more.
Pricing:
- Growth – $49/mo, 5,000 monthly credits, one user, two campaign accounts, up to 400 daily emails.
- Startup – $150/mo, 18,000 monthly credits, four users, four campaign accounts, up to 500 daily emails.
- Suite – $399/mo, 30,000 monthly credits, six users, ten campaign accounts, up to 750 daily emails.
Best features: Bulk processing, email sender, campaign analytics, automated sending, and more.
Once you find someone’s email address, you should also know how to start your email.
How to Validate an Emails Address Before Outreach
There’s nothing worse than crafting the perfect email cold message only to find that the email you used isn’t the correct one.
Whether you’re sending a full automated email outreach campaign or just a handful cold emails, it’s always a good idea to validate your contact info!
To confirm your email info, you can use any of the email marketing tools mentioned above, or some email verifier tools.
Here’s a quick overview of how this works:
- Most email outreach tools also have an email verification feature.
- Usually, you can verify up to 50 emails for free with most email tools.
- If you want to confirm a few handful emails before sending that personalized cold email, you can also use a few free tools. Though, keep in mind most free tools don’t allow you to upload spreadsheets, or enable you to confirm only up to a certain number of emails.
- The process is simple: You either manually enter your email in the tool form or upload your spreadsheet full of emails.
Sending Hyper-Personalized Cold Emails As Well as LinkedIn Messages At Scale, On Autopilot
You might want to read this before you send that cold email.
As good as email outreach is for capturing attention, your prospects probably get up to 100s of emails per day, probably more if they work in B2B or sales.
So, if you really want to stand out, one way to do so is through the use of hyper-personalized, omnichannel messages via Email AND LinkedIn.
And the best way to do this is by setting up full marketing funnel automation with Expandi.
For example, this way, you can send a LinkedIn connection request, and email follow-up to remind them to connect with you, and then, continue to an InMail messaging flow if they still haven’t responded.
Or, you could do it the other way around, starting with an email touchpoint first, and then moving the campaign to LinkedIn.
You can do all this, and more, with Expandi V2.
Get started with a free, 7-day Expandi trial and launch your own email and LinkedIn outreach campaigns today!
