You found the right person on LinkedIn. Head of Growth at a company that fits your ICP perfectly. Now you want to email them, not drop another message into an inbox they check twice a month.
The problem: LinkedIn does not want you to have their email. It hides addresses by default, and the "LinkedIn email finder" extensions that promise to fix this mostly work by scraping the site - which LinkedIn's User Agreement prohibits and which can get your account restricted.
There is a cleaner route. It takes about three minutes per person, uses free tools, and never touches LinkedIn with anything automated.
The short version
- Check Contact info on their profile. Sometimes the email is just there.
- Get the company domain from their LinkedIn company page.
- Find the company's email pattern with a domain lookup.
- Build the address from their name and that pattern.
- Validate it before you hit send.
The rest of this post is the detail for each step, plus what to do when it does not work.
Step 1: Check Contact info first (it takes ten seconds)
Open their profile and click Contact info under their name and headline.
Every member decides who can see their email address. Some show it to all 1st-degree connections, a few show it to everyone, and many show it to nobody. If you are already connected, there is a fair chance it is sitting right there.
While you are in that panel, look at the other links too. A personal website, a GitHub profile, a newsletter, or a Calendly link often leads straight to a published address - and an address someone published themselves is the best kind to use.
If you are not connected, you will not see it. Do not send a connection request just to harvest the email. People notice, and it reads exactly like what it is.
Step 2: Get the company domain from LinkedIn
Click the company name in their Experience section to open the company page. The Website link in the About section is the domain you want.
This step matters more than it looks. Companies often run several domains - the marketing site, a product domain, an old brand they rebranded from, a regional ccTLD. Work email usually lives on just one of them. If the company page says acme.io but you have seen getacme.com in ads, check both in the next step.
Two quick sanity checks:
- Is the profile current? If their latest role started "2 yrs" ago at a seed-stage startup, check that the company still exists before you spend any more time.
- Is this a subsidiary or acquisition? Acquired companies often move staff to the parent's domain within a year.
Step 3: Find the company's email pattern
Most companies use one consistent format for everyone. Once you know it, you can construct anyone's address.
Put the domain into a company email finder and look at the addresses that come back. You are not looking for your person - you are looking for the shape:
| If you see | The pattern is likely |
|---|---|
sarah@acme.io |
first@ |
sarah.chen@acme.io |
first.last@ |
sarahchen@acme.io |
firstlast@ |
schen@acme.io |
flast@ (first initial + last name) |
sarah.c@acme.io |
first.l@ |
Two or three personal addresses that agree are enough to be confident. One address is a hint, not a pattern.
Ignore role addresses like hello@, sales@, or support@ for this step. They tell you the domain accepts mail, but nothing about how personal addresses are built. (They are also where cold email goes to die - a shared inbox triaged by whoever is on rotation.)
Small companies are the exception. At a ten-person startup, founders often use first@, while everyone hired later gets first.last@. If your person is a founder or very early employee, try the shorter form first.
Step 4: Build the address
Take the name exactly as it appears on their profile and apply the pattern. Then deal with the edge cases that trip most people up:
- Nicknames. Their profile says "Mike", their email may say
michael. If the pattern check showed full first names, try the formal version too. - Double-barrelled and compound surnames.
garcia-lopez,garcialopez, andgarciaare all common. Check whether any address from step 3 had a hyphen. - Accents and non-Latin characters.
joséalmost always becomesjosein an email address. - Name changes. Someone who changed their surname after marriage may still have the old one in their address, or both.
When you are unsure between two or three versions, do not send to all of them. Validate each one (next step) and send to the one that passes.
Step 5: Validate before you send
A guessed address you never verify is how sender reputations quietly get wrecked. Every hard bounce tells mailbox providers you are sending to lists you did not build carefully, and enough of them pushes your good emails into spam too.
Run the address through an email validator. It checks:
- Syntax - catches typos before they cost you anything.
- Domain and mail server - does this domain accept email at all?
- Mailbox - where the server allows the check, does this specific mailbox exist?
One honest caveat: some domains are catch-all. They accept mail for any address, real or not, so no validator can confirm the mailbox. If you get a catch-all result, the pattern work from step 3 is doing the heavy lifting. Send if your pattern evidence is strong; skip it if you were guessing.
For the longer explanation of bounce rates and list hygiene, see how to reduce bounce rates with email validation.
What about the extensions and "LinkedIn email finder" tools?
Search "linkedin email finder" and most results are browser extensions that add a "find email" button to LinkedIn profiles. They are convenient, and plenty of salespeople use them.
Know what you are trading:
- Account risk. LinkedIn's User Agreement prohibits scraping and using software that automates activity or copies profile data. Extensions that read profiles as you browse fall into that territory, and LinkedIn does restrict accounts it flags. For a founder whose LinkedIn presence is the brand, that is a bad bet.
- Data you cannot inspect. Many of these tools pull from large contact databases. Addresses can be years out of date, and you have no way to see how they were collected.
- Compliance exposure. If you email EU or UK contacts, you are responsible for where their data came from. "A Chrome extension gave it to me" is not a great answer.
The pattern method gets the same result for most work emails, and every input is something you looked up yourself.
When you still cannot find it
Some people are genuinely hard to reach by email: very senior people at large companies, people at firms with unusual formats, or people whose company uses a catch-all you cannot verify. Options, in order of how well they tend to work:
- Ask on LinkedIn, briefly. "I have a short note about [specific thing] - is email better for you?" Plenty of people reply with their address, and you start with permission.
- Find where they show up publicly. Conference talks, podcast appearances, open source commits, and community threads often include a contact address - and give you something real to reference.
- Reach a colleague. If the decision sits with a team, someone one level down with a findable address can be a better first contact anyway.
- Skip email entirely. If they are actively asking questions in a public community, replying there with a genuinely useful answer usually beats any cold email.
That last point is the one we built Needle around (disclosure: it is our product). It searches public communities like Reddit, Hacker News, and Stack Overflow for people already asking for what you sell, so the first touch is a helpful reply instead of a cold one. When email is still the right move, the free company email finder handles the domain lookup above.
A worked example
Say you want to reach Priya Raman, Head of Growth at a fictional company called Lumen Analytics.
- Contact info: not shown - you are not connected.
- Company page: the Website field says
lumenanalytics.com. - Pattern lookup: results include
daniel.okafor@lumenanalytics.comandmei.tan@lumenanalytics.com, plus ahello@address. Two personal addresses agree:first.last@. - Build:
priya.raman@lumenanalytics.com. - Validate: the domain accepts mail and the mailbox check passes. Send.
Total time: about three minutes, no extensions, and you know exactly why you trust the address.
Before you write the email
Finding the address is the easy half. A few habits make sure it was worth finding:
- Reference something specific - a post they wrote, a hire they are making, a problem their company talked about publicly. If you could send the same email to fifty people, do not send it to this one.
- Keep it short. Three or four sentences and one clear question.
- Respect the rules. In the US, CAN-SPAM requires honest sender details, a physical address, and a working opt-out. In the EU and UK, GDPR means your reason for contacting them has to be relevant to their role and easy to decline. (Not legal advice - check where your recipient is based.)
- Log it. Note where you found the address and when you sent. If they ask, you can answer.
For the rest of the outreach workflow - who to contact and how to write the message - see the B2B email finder playbook and what still works for founder-led outreach on LinkedIn.