You know who you want to reach. You know where they work. You do not have their email address, and no amount of searching turns one up.
This is the most common situation in B2B prospecting, and it has a solution that is more reliable than most people expect — because corporate email addresses are not arbitrary. They are generated by a rule, and the rule is usually one of about five.
The catch, which this article is largely about, is that deriving an address is guessing, and a guess that has not been checked is a bounce with a confident face on it.
Corporate email is not random, and that is the whole opportunity
When someone joins a company, nobody invents their address. An IT system applies a rule to their name. That rule is set once, when the domain is configured, and it rarely changes.
Which means that if you know the rule and you know the name, you know the address. The rules in circulation:
first.last@company.com— the most common in mid-market and enterprisefirst@company.com— startups and small teams, where collisions are unlikelyflast@company.com— very common in US enterprise and financefirstl@company.com— a distant fourthfirst_last@company.com— rare but reallast.first@company.com— rare in the anglophone world, more common elsewhere
A handful of patterns covers the overwhelming majority of companies you will ever want to write to. That is the entire basis of every email finder on the market.
Finding the pattern: the step that makes everything else cheap
You do not need to guess the pattern. You need one real address at that company, and then the pattern is simply readable from it.
Where to find that one address:
- The privacy policy. Almost always contains a real, monitored address, because data-protection law requires a contact route. This is the single most reliable source on any website and almost nobody uses it.
- The contact or press page. Our contact page finder locates it.
- A job listing. Frequently carries a hiring manager's address directly.
- The footer, on every page of the site.
- A PDF. Whitepapers and brochures are full of contact details and nobody crawls them. Our PDF extractor does.
Once you have sarah.chen@acme.com and you know Sarah Chen is a real person there, you know the pattern is first.last, and you can now derive every other person at Acme. One lookup, an entire company unlocked. Our company email pattern finder automates the inference.
Permutation: generating the candidates
When you cannot find a single real address, you fall back to permutation — generate every plausible address and test them all.
For "Sarah Chen" at "acme.com", the candidate set is roughly: sarah.chen@, sarah@, schen@, sarahc@, chen@, sarah_chen@, s.chen@, chen.sarah@, sarahchen@.
Nine candidates. At most one is correct, and possibly none. Our name-to-email finder generates and ranks these by how common each pattern actually is, which matters — testing in order of prior probability means you usually find the right one in the first two or three attempts rather than the ninth.
But note what you have at this point. You have nine hypotheses. You do not have an email address. The difference is not pedantic; it is the difference between a campaign and a bounce rate.
The verification step, which is not optional
Verification is what collapses nine hypotheses into one fact — or into none, which is also a fact and a useful one.
The check connects to the company's mail server and asks, essentially, whether it would accept mail for that mailbox. A real address is confirmed. A wrong guess is rejected. This is what our email verifier does for a single address and what the verification API does at volume.
Skip this and the arithmetic is brutal. Nine candidates, one correct: send to all nine and you have an 89% bounce rate on that contact. Do that across a list and your sending domain will be in serious trouble within a single campaign — the mechanism is set out in detail in our piece on bounce rates and sender reputation.
Derivation without verification is not a shortcut. It is a way of converting a prospecting problem into a deliverability problem, which is a much worse problem to have.
Catch-all domains: where the method genuinely breaks
A catch-all domain accepts mail for every address, real or not. Ask it whether sarah.chen@ exists and it says yes. Ask it whether qwertyuiop@ exists and it also says yes.
Which means verification returns "valid" for all nine of your candidates, and you have learned precisely nothing. This is the single hardest case in the entire discipline, and it is common at exactly the large companies you most want to reach.
What an honest tool does here is say so — "unknown, catch-all domain" — which is what our catch-all detector reports. What a dishonest tool does is report "valid" and let you discover the truth when the campaign lands nowhere. When a vendor advertises 98% accuracy, this is almost always where the number comes from.
What to do instead: find a real address at the company by other means (privacy policy, press page, PDF), which establishes the pattern directly and removes the need to guess. If you genuinely cannot, treat the derived address as an unknown — send it in a small, separate wave, watch what happens, and never mix it into your main campaign.
The names that break derivation
Pattern derivation assumes the name on the profile is the name in the directory. Frequently it is not.
- Nicknames. "Robert Chen" on LinkedIn is
bob.chen@in the directory. "Katherine" iskate@. This is the most common failure by a wide margin. - Middle names and initials. Some companies include them; most do not, but some directories disambiguate collisions that way.
- Collisions. Two Sarah Chens means one of them is
sarah.chen2@orsarah.c.chen@, and there is no way to know which from outside. - Non-Latin names and transliteration. A name rendered one way on a profile may be transliterated differently in the mail system, and there is often no single correct answer.
- Naming order. In several cultures the family name comes first, and a naive parser will reliably derive the address backwards.
- Married and maiden names. Someone may have changed their public name and kept the original address for a decade.
The practical rule: if the top-ranked candidate fails verification, do not discard the person. Try the nickname variants and the initial forms before you conclude they are unreachable. And if you have any evidence of what they are actually called — a byline, a commit, a conference programme — use that name rather than the formal one.
When the company itself defeats you
Some domains simply will not yield to this method, and it is worth recognising them early rather than burning a campaign on them.
Companies with no MX record. The domain does not receive mail at all. Frequently a marketing domain, with the real mail on a different one. Check the MX before anything else — it costs nothing and it saves you deriving nine addresses at a domain that cannot receive any of them.
Companies behind aggressive filtering. Some enterprises reject SMTP verification probes outright, which means your check returns "unknown" for entirely legitimate addresses. Absence of confirmation is not evidence of absence here.
Recently acquired companies. Profiles say one domain, mail routes to the parent. The derived address is well-formed and bounces every time.
Companies that use a mail gateway. The pattern in the directory may differ from the pattern the gateway accepts, which produces the frustrating case where a correct address is rejected by the check.
None of these are your fault and none are fixable by better guessing. They are cases where the honest answer is "I could not establish this address", and where the right move is either a different route in — the contact form, a colleague, the company's general address — or moving on to a prospect where the method works.
Doing it at scale, without doing it badly
One address is a manual exercise. A thousand is a pipeline, and pipelines fail differently.
The order that works:
- Group by company, not by person. Establishing one pattern unlocks every contact at that company. Doing it person-by-person repeats the same work dozens of times.
- Check the domain first. MX record, catch-all status, disposable. A domain-level check costs one lookup and can eliminate an entire company's worth of pointless derivation.
- Derive candidates, ranked by prior probability.
- Verify in rank order and stop at the first confirmation. There is no point testing the other eight once one has confirmed.
- Segment the output into confirmed, catch-all-unknown, and failed. These three groups must never go into the same campaign, because the risk profiles are completely different.
- Enrich the confirmed set so you know who these people actually are before you write to them. Enrichment is what turns an address into a reason to send.
Our bulk domain-to-email converter handles the company-level version of this, and Govarova Email Finder runs the whole chain — pattern, permutation, verification — as a single operation.
Free-mail addresses, and what they actually tell you
Sometimes the person you want does not have a corporate address at all. The company's contact is a Gmail address, and pattern derivation has nothing to work with.
This is not a failure of the method. It is information, and it is information most prospecting workflows throw away.
A free-mail address as the primary business contact usually means one of three things: a very small business, a sole trader, or a company so young it has not yet configured a domain. Each of those is a different prospect with a different budget, a different decision process, and a different reason to care about what you sell — and all three are invisible if you simply mark the row "no corporate email found" and move on.
For a two-person plumbing firm, bobsplumbing@gmail.com is not a data-quality problem. It is the correct and only contact route, and a prospecting system that discards it is discarding the entire local-business segment. Our business-vs-free email detector makes this distinction explicit rather than silently treating one as inferior to the other.
The mistake to avoid is deriving a corporate address for a company that does not have one. If acmeplumbing.com has no MX record, then bob@acmeplumbing.com cannot receive mail no matter how confidently your tool generated it. Check the MX. It is one lookup and it prevents an entire category of confident, well-formed, undeliverable guesses.
Confidence scores, and how to read them honestly
Most email finders return a confidence score, and most users treat it as a probability. It generally is not one.
What a confidence score usually encodes is some combination of: how common the pattern is, whether the domain was verifiable, whether the tool has seen this address before in its own data, and how many sources agree. These are reasonable inputs. What they do not produce is a calibrated probability that this specific mailbox exists.
The test of whether a score is meaningful is calibration: of all the addresses a tool rates at 80%, do roughly 80% actually deliver? Almost no vendor publishes this, and the ones that do usually discover it is not true.
How to use scores sensibly despite that:
- Treat them as a ranking, not a probability. A 90 is more likely than a 60. That is all you can safely conclude.
- Never send to an unverified address regardless of its score. A 95% confidence guess at a catch-all domain has been checked by nobody.
- Track your own bounce rate by score band. Within a month you will know what the tool's numbers actually mean on your data, which is the only calibration that matters.
Our own tools are deliberately explicit about the difference between a derived candidate and a verified address, because collapsing the two is the thing that costs people their sending domain — and a number that hides the distinction is worse than no number at all.
What to do with the address once you have it
Finding the address is not the goal. It is the least valuable part of the whole exercise, and it absorbs most of the attention.
An address with no context is a row in a spreadsheet. You know that sarah.chen@acme.com exists. You do not know whether Sarah is the person who buys what you sell, whether Acme has the problem you fix, whether they already bought a competitor's product last quarter, or whether they are three people in a garage or three thousand people across four continents.
All of which determines whether writing to her is a good idea, and none of which the address tells you.
This is what enrichment is for: address in, context out. Role, seniority, company size, industry, technology stack, funding. Our free email enrichment tool shows the shape of it, and the employee count finder and tech stack detector each answer one of the qualifying questions on their own.
The order matters and is usually reversed. People find a thousand addresses and then wonder who to write to. The better sequence is to decide who is worth writing to, and then find those addresses — which is far less work, because you are looking for fifty addresses instead of a thousand.
Keeping the addresses you found
An address is a perishable asset. A B2B list decays at roughly 2 to 2.5% a month as people change jobs, which compounds to about a quarter of your list dead within a year.
Worse, the decay is not evenly distributed. Senior people move more often than junior ones. Fast-growing companies restructure constantly. The most valuable segment of your list is also the fastest-rotting, which means the cost of stale data lands hardest exactly where you can least afford it.
Three habits that keep a database alive:
- Re-verify before every campaign, not once at import. A list verified in January is not a verified list in June; it is an unverified list with a comforting memory attached.
- Treat a bounce as a job change, not just a bad address. A hard bounce at a company you care about is a signal that someone left — which means there is a new person in that role, and a vacancy is one of the strongest buying signals there is.
- Record where each address came from. When it bounces, the source tells you whether to re-derive it (pattern still valid, person gone) or discard the company entirely (domain dead).
That second habit is the one that turns list decay from a cost into a signal. Every bounce is telling you something changed. Most teams hear only "bad data".
The legal question, briefly but honestly
Deriving someone’s work email address from their name and their employer means creating a piece of personal data about an identifiable person. Under the GDPR, and its UK equivalent, that is processing, and processing requires a lawful basis.
Legitimate interest is usually the right basis for B2B outreach, and it genuinely can cover this. But it is a three-part test — is the interest legitimate, is the processing necessary for it, and does it survive a balancing exercise against the individual’s rights and reasonable expectations — and you are expected to have actually done that test rather than merely to have heard of it.
What that means in practice is unglamorous and entirely achievable:
- Write to people whose job plausibly involves what you are writing about. This is not politeness; it is the substance of the necessity limb of the test. A message to someone with no professional connection to your product fails it.
- Identify yourself properly. Real name, real company, real address. An email that conceals who sent it cannot be justified under any basis.
- Honour every opt-out immediately and permanently, however it is phrased, and across all campaigns rather than the one they replied to.
- Keep a record of where the data came from. If someone exercises a subject access request — and they can — “a tool gave it to us” is not an answer.
The US position is different and generally more permissive: CAN-SPAM does not require consent for commercial email, but it does require accurate headers, a working opt-out, and a physical postal address in the message. Different rules, similar spirit: be who you say you are, and let people leave.
None of this makes derived-address outreach unlawful. It makes the careless version unlawful, and the careful version perfectly defensible — which is the same distinction that runs through every other part of this article.
The method in one paragraph
Find one real address at the company — the privacy policy is the most reliable source and the least used. Read the pattern from it. Apply the pattern to the name you want. Verify the result against the mail server. If the domain is a catch-all, accept that you do not know and treat the address accordingly rather than pretending. If verification fails, try the nickname variants before giving up on the person. Then enrich what survived, so that when you write, you have something to say beyond the fact that you managed to find them.
That is the whole method. The tools — our Email Finder, the pattern finder, the verification API — automate the mechanical parts of it. The judgement about who is worth the effort remains yours, and it is the part that determines whether any of the rest was worth doing.
The honest accuracy question
Every vendor in this space quotes an accuracy figure, and the figures are mostly meaningless, because nobody defines the denominator.
Ask three questions of any number you are shown:
- Does "accurate" mean the mailbox exists, or that the tool returned something? Those are very different claims, and the second is trivially easy to score highly on.
- What happens with catch-all domains? If they are counted as "found", the accuracy figure is inflated by exactly the cases where the tool knows least.
- What is the coverage? A tool that returns an address for 30% of queries and is right 99% of the time is very different from one that returns an address for 95% of queries and is right 70% of the time — and the second will quote you the better-sounding number.
The figure that actually matters to you is neither of those. It is your bounce rate on the addresses the tool gave you. That is the only number measured on your domain, in your campaign, with consequences you personally bear. Everything else is marketing.
Which is why every route through this article ends in the same place: derive if you must, but verify before you send. The derivation is the clever part and the verification is the part that keeps you in business.
Guesswork scales badly. Govarova Email Finder returns a verified address from a name and a company in one step, and you can try it free.
