Free work email finder

What this finder actually does

Type a first name, a last name, and a company domain. We generate the common work-email patterns for that name — jane.doe@, jdoe@, jane@, and the rest — then ask the domain's mail server whether any of those mailboxes exist. The answer you get back is from that conversation, not from a public directory of people.

That distinction matters more than the form suggests. A database can tell you that *someone* at a company once used jane.doe@company.com. It cannot tell you whether the mailbox still accepts mail this morning. People change jobs. IT turns catch-alls on and off. Microsoft 365 tenants get renamed. The only source that knows the current state of a mailbox is the server that would receive the message.

A few free lookups a day run on this page with no account. Past that, sign up. You are charged a credit only when the mailbox comes back verified. Catch-alls, misses, and looking up the same person again are free. Credits never expire.

What you type in

Three fields. That is the whole input.

• First name and last name as the person would appear on a company site or LinkedIn. Accents are fine; we normalise them. Do not put a job title, a company name, or a LinkedIn URL in the name fields.
• Company domain, not the company name. stripe.com, not "Stripe". If you only have a website like www.company.com/about, use the registrable domain: company.com. Subdomains such as mail.company.com are the wrong thing to verify against — MX records live on the apex the company actually receives at.

If you are not sure of the domain, look at the company's own website, not at a guessed @company.io vs @company.com. The finder will happily check the wrong domain and give you a clean miss.

What happens after you submit

1. We look up the domain's MX record so we know which mail server to talk to. No MX usually means the domain does not receive mail at all.
2. We generate candidates from the 13 work-email patterns we actually use in production. Illustrative only: for Jane Doe at company.com that is jane.doe@company.com, jane@company.com, jdoe@company.com, and so on. We never publish a real person's address on this site.
3. We start an SMTP conversation with the mail server — the same handshake a real send would start — and stop one step before delivery. The server either accepts the mailbox, rejects it, or accepts *everything* (a catch-all).
4. We return one labelled result. We do not return a list of "maybe" addresses dressed as hits.

That is mailbox-level verification, not a syntax check and not "the domain exists." Plenty of tools stop at the domain and still print verified. They are not the same thing.

How to read the result

Verified. The mail server accepted that specific mailbox. This is the only status that belongs in a cold sequence. It is also the only status that spends a credit.

Catch-all. The domain accepts mail to any local-part. No verifier, us included, can confirm a specific person there. We still return the most likely pattern so you can decide whether the bounce risk is worth it. We do not charge you for that guess, and we do not call it verified.

Not found. None of the candidates were accepted, and the domain is not a catch-all. The person may use a nickname, a different domain (a parent company, a regional subsidiary), or they may simply not have a mailbox there.

Predicted. We have a pattern match that never got a SMTP verdict — usually because the server would not talk to us. Treat it like a guess. It is free.

If a tool you already use never mentions catch-alls, assume it cannot tell them apart from a hit.

A worked example (fictional)

Jane Doe works at a company whose website is company.com. You type Jane, Doe, company.com.

• If the mail server accepts jane.doe@company.com and rejects a probe to a made-up local-part, you get verified on jane.doe@company.com. That is a mailbox you can send to.
• If the server accepts both jane.doe@company.com *and* zzzzz@company.com, you get catch-all. The pattern is probably right; the mailbox is unconfirmed. Do not dump that into a 5,000-row sequence on a warming domain.
• If every candidate is rejected, you get not found. Try a nickname (Jan vs Jane), a maiden name, or the domain the company actually receives mail on — often not the marketing site.

Jane Doe is not a real person at that domain. The example exists so the statuses are concrete.

When this is the right tool

Use the finder when you have a *person* and a *company*, and you need the work address that will accept mail today.

• Building a short list from LinkedIn or a conference page.
• Checking one contact before you hit send in Gmail.
• Sanity-checking a vendor's export before you pay for a sequencer seat.

Use bulk find or the API when the list is already a spreadsheet. Use the permutator when you only want to see the candidate addresses, with no SMTP. Use the verifier when you already have an address and just need a yes/no/catch-all.

When this is the wrong tool

• Personal Gmail / Outlook.com / Yahoo. This product finds *work* mailboxes. Consumer inboxes are a different problem and a different set of rules.
• School, government, or healthcare tenants you have no reason to contact. A technical "verified" does not make the send legal or welcome. Check CAN-SPAM / GDPR against your own counsel, not against this page.
• Scraping a company directory to publish it. We will not help you build a public people search. Hunter withdrew from that in 2026 for a reason.

What the free cap is for

The public finder talks to live mail servers. That costs us money even when it is free for you, so the page shares a daily cap with every other public lookup on the site. DNS tools — MX, SPF, DKIM, DMARC, the generators, the calculators — do not share that cap. They are uncapped because they only read public DNS or run in your browser.

When you hit the cap, create an account. The paid product is the same check, metered per verified hit.

Common mistakes

• Pasting @company.com in the domain field, or https://company.com. Strip the protocol and the at-sign.
• Using the email *you already have* as the name. If you already have the address, use the verifier.
• Treating catch-all as verified because "it didn't bounce in a test send to yourself." Catch-alls do not bounce. That is the whole problem.
• Running 50 one-off lookups by hand instead of uploading a CSV. The result is the same; the click-count is not.

What it costs after the free lookups

Plans start at $9/month for 1,000 credits. One credit is one confirmed mailbox. Catch-alls, misses, and repeats are free. The pricing page is the source of truth, including the annual rates. We do not invent competitor numbers on this page — if you want a side-by-side, use the comparison that cites each vendor's own pricing page.

Related reading

• How to verify a work email before you send
• Why “verified” email finders often aren’t
• Catch-all domain in the glossary
• Work email formats for the 13 patterns behind the candidates