LinkedIn is the best B2B prospecting database ever assembled, and it is deliberately built so that you cannot email anyone on it.

That tension is the whole problem. You can see the person, their role, their tenure, the size of their team, the fact that they were promoted four months ago and are probably still building out their function. What you cannot see is the one field you need. LinkedIn knows exactly what it is doing: the address is the moat.

So an entire industry has grown up around bridging that gap, and most of what it publishes is either technically wrong, legally reckless, or both. This piece is an attempt to be straight about all three parts: how the lookup actually works, which approaches are reliable, and where the lines genuinely are.

First, the uncomfortable part: what is actually allowed

Almost every guide on this topic skips this section, which tells you something about the guides.

Scraping LinkedIn violates LinkedIn's terms of service. Not ambiguously — explicitly. Their user agreement prohibits using bots or automated methods to access the service or copy data from it. They enforce this. Accounts get restricted and banned, and the ban is usually permanent and applies to the human, not just the tool.

The legal position beyond the ToS is genuinely more nuanced. The long-running hiQ Labs v. LinkedIn litigation in the US established, roughly, that scraping public data is not a criminal violation of the Computer Fraud and Abuse Act — but it also ended with hiQ losing on breach of contract, because they had agreed to the terms of service. "Not a federal crime" and "allowed" are very different statements, and the gap between them is where a lot of people get hurt.

Then there is data protection. In the EU and UK, a work email address attached to a named person is personal data under the GDPR. You need a lawful basis to process it. Legitimate interest can cover B2B prospecting, but it is a test you have to actually pass and document, not a phrase you invoke — and it requires that your interest is balanced against the person's reasonable expectations. Someone who put their profile on LinkedIn did not thereby consent to being added to a cold email sequence.

None of this means B2B outreach is forbidden. It means the sloppy version is exposed, and the careful version is fine. The practical implications:

  • Do not run automated scrapers against LinkedIn. The ToS risk is real and the ban is permanent.
  • Do keep a record of where each contact came from. If someone asks — and under GDPR they can — "we don't know" is not an answer.
  • Do honour opt-outs immediately and permanently, including for people who never opted in.
  • Do target people whose job plausibly involves the thing you are writing about. This is not merely polite; it is the substance of the legitimate-interest test.

The three ways an email address is actually obtained

Underneath all the tooling, there are only three mechanisms. Everything on the market is one of these, or a combination.

1. It is found. The address exists publicly somewhere — a conference speaker page, a GitHub commit, a press release, a company team page, a PDF. A crawler found it and stored it. This is the strongest kind of result, because the address is real and was published.

2. It is derived. The tool knows the company's email pattern (say, first.last@company.com), knows the person's name from LinkedIn, and constructs the address. This is a guess — an educated one, but a guess.

3. It is verified. Whether found or derived, the candidate address is checked against the mail server to see if the mailbox exists. This is what turns a guess into something you can send to.

The critical insight, and it is the one most vendors blur: a derived address that has not been verified is not a lookup. It is a hypothesis. When a tool hands you an address with an "85% confidence" score and no explanation, what it is usually telling you is that it guessed and did not check.

Why company email patterns are more predictable than they should be

Derivation works because organisations are boring. A remarkably small number of patterns cover the overwhelming majority of companies:

  • first.last@company.com — the most common in mid-size and enterprise
  • first@company.com — startups, small teams
  • flast@company.com — very common in the US, especially finance and legacy enterprise
  • firstl@company.com — a distant fourth
  • first_last@company.com — rare, but it exists

If you know one real address at a company, you know the pattern, and therefore you can derive every other address at that company. That single fact is what makes company-level prospecting so much more efficient than person-by-person lookup — find one, and you have found the shape of all of them.

Our free company email pattern finder does exactly this: give it a known address, and it tells you the pattern in use. Our name-to-email finder runs the derivation the other way — name plus company, ranked candidates out.

But note the word candidates. A pattern gives you a ranked list of hypotheses, and hypotheses have to be tested.

The verification step that separates a lead from a liability

Suppose you have derived sarah.chen@acme.com. What do you actually know?

You know that Acme probably uses first.last, and that a Sarah Chen probably works there. You do not know whether she uses a middle initial, whether there are two Sarah Chens and she is sarah.chen2, whether she goes by Sara internally, whether she has left, or whether Acme uses a completely different pattern for anyone hired after their 2023 migration.

Sending to an unverified derived address is how bounce rates get to 15%, and — as covered at length in our piece on email verification and sender reputation — a high bounce rate does not merely waste the bad addresses. It degrades delivery to the good ones. You can poison a domain with guesses.

So the sequence is not optional:

  1. Derive the candidates from the pattern.
  2. Verify each against the mail server. Our free email verifier does this for a single address; the verification API does it in bulk.
  3. Send only to what verified. Discard the rest, or treat them as a separate, higher-risk wave.

The temptation is to skip step two because it reduces your list. That reduction is the point. A list of 200 verified addresses will outperform a list of 800 guesses, and it will not cost you your sending domain.

Catch-all domains: where this gets genuinely hard

Here is the case that breaks the neat sequence above, and it is worth understanding because it is common at exactly the companies you most want to reach.

A catch-all domain accepts mail for any address, existing or not. Write to nonsense@bigcompany.com and the server says yes. Which means verification cannot tell you whether your derived address is real — the server says yes to everything, so "yes" carries no information.

Combine that with derivation and you have a genuinely dangerous combination: a guessed address at a domain that will accept anything. The verifier says "valid". Nothing has been validated. The mail will be accepted, delivered nowhere, and silently discarded — or worse, land in a catch-all mailbox that a security team reads.

An honest tool reports this as "unknown — catch-all", which is what our catch-all detector does. A tool that reports it as "valid" is not more capable; it is less truthful. When you see a vendor advertising 99% accuracy, the first question to ask is what they do with catch-alls, because that number is usually built on calling them all valid.

What to do about a derived address at a catch-all domain: prefer a found address if one exists anywhere, use the company's contact form or a colleague's confirmed address as a route in, or accept it as a genuine unknown and put it in a small, separate, closely-watched send. Do not put it in your main campaign.

The methods, ranked by how much they actually work

Best: the address the person published themselves. Conference bios, personal sites, GitHub, academic pages, "contact me" links. This is a real address that a real person chose to make public. It is also, not coincidentally, the safest ground under GDPR — the person's reasonable expectation is that people will use it.

Very good: the company website. Team pages, press contacts, careers pages, and the addresses embedded in job listings. Our website email extractor and job listing extractor both work this ground.

Good: pattern derivation plus verification. Reliable at non-catch-all domains, and the workhorse of most B2B prospecting. Just do not skip the verification.

Mediocre: guessing without verification. This is where bounce rates come from. It feels productive because the spreadsheet fills up. It is actively destructive.

Bad: automated LinkedIn scraping. Against the ToS, gets accounts banned permanently, and produces data you cannot account for the provenance of when someone asks.

Worst: buying a list. You inherit someone else's spam traps, someone else's stale data, and no lawful basis at all. Purchased lists are how domains die, and the seller has no incentive to tell you what is in there.

What to do with the LinkedIn profile itself

The profile is not just a name to feed into a pattern. It is the raw material for the only thing that makes cold outreach work, which is having something specific to say.

The tenure tells you whether they inherited the problem or created it. Someone three months into a role is still deciding what to fix; someone six years in has already decided and is defending it. Those require completely different emails.

The team size, visible from the company page, tells you whether they are an operator or a manager. The recent posts tell you what they are currently annoyed about. The job listings on their company page tell you where they are investing — a company hiring three SDRs has just decided that outbound matters, and has not yet built the machinery.

This is the material that turns a derived address into a reply. As argued in our piece on cold email subject lines, the single strongest signal you can send is evidence that you actually looked. The profile is where you look.

Enrichment: going the other direction

Often the problem runs the other way. You have an address — from a form fill, a webinar, a conference badge scan — and you know nothing about the person.

That is enrichment: address in, profile out. Job title, company, headcount, industry, technologies, funding stage. It matters because a signup with no context is a lead you cannot route, prioritise, or write to intelligently.

Our free email enrichment tool demonstrates the shape of it, and Govarova Enrichment does it at volume, including the company-level firmographics that let you decide whether an inbound signup is a solo founder or a 500-person enterprise before anyone picks up the phone.

The two directions are complementary. Prospecting finds people you chose. Enrichment tells you about people who found you. Most teams are much better at one than the other, and the neglected side is usually where the cheapest wins are.

A workflow that holds up

Putting it together, without any of the parts that get you banned:

  1. Define the company list first, not the person list. Firmographics, technology, headcount, hiring signals. Who plausibly has the problem you solve?
  2. Find one real address per company. Website, press page, job listing. One is enough.
  3. Derive the pattern from that one address.
  4. Identify the right person on LinkedIn — manually, reading the profile, because that reading is where your email actually comes from.
  5. Derive their address from the pattern and their name.
  6. Verify it. Every time. Segment out the catch-alls and the unknowns.
  7. Write something that could only be sent to them, using what you read in step 4.
  8. Record where the data came from, so that when someone asks, you can answer.

It is slower than a scraper. It is also durable, defensible, and it produces reply rates that a scraped list never will — because the constraint that makes it slow is the same constraint that makes it work.

Sales Navigator, and why it changes the arithmetic

If you are doing this at any volume, the filtering is the bottleneck long before the address lookup is. LinkedIn's own Sales Navigator is, awkwardly for everyone selling an alternative, extremely good at the filtering part — headcount growth, job changes in the last ninety days, technology used, department size, seniority.

Those filters are the actual product. The list of people it produces is more valuable than any scraped database, because it is current: LinkedIn's data is updated by the people themselves, continuously, for free, which is a data-acquisition model no vendor can match.

What Sales Navigator will not do is give you an email address, and it will not let you export. Which lands you back at the same wall — but with a much better list to take to it, and a much stronger argument for doing the lookup carefully rather than at volume. A hundred people who match a "hired two SDRs in the last quarter and uses HubSpot" filter are worth more than fifty thousand people who work in sales.

The honest framing: use LinkedIn for what it is genuinely best at — identifying who — and do the address work elsewhere, from the company's own published data. That division respects the ToS, uses each source for its strength, and produces a better list than either half alone.

Job changes: the single strongest buying signal on LinkedIn

Of everything visible on a profile, one thing outperforms the rest by a wide margin, and most people ignore it.

A person who started a new role in the last ninety days is dramatically more likely to buy than the same person eighteen months in. The reasons are structural rather than psychological. A new leader has a mandate to change something, has budget that has not yet been committed, is not personally invested in the tools their predecessor chose, and is actively looking for wins to justify the hire.

Eighteen months later, that same person selected the incumbent tool, defended it in a budget meeting, and now has a professional stake in it working. You are no longer selling to a buyer; you are asking someone to admit a mistake.

The practical move is to build your prospecting around role changes rather than around companies. It inverts the usual approach — instead of picking target accounts and waiting, you watch for the trigger and move when it fires. It is also the reason the "congratulations on the new role" email is such a cliché: the instinct is right, and the execution is lazy. The instinct says the moment matters. The execution wastes it on a platitude.

What to send instead is something specific to the thing they have just been hired to fix — which requires knowing what that is, which requires reading the job listing that was posted before they were hired, which is still on the company careers page, and which our job listing extractor will find for you.

Common mistakes that quietly ruin the list

Five failures that account for most bad prospecting data:

  • Assuming the LinkedIn name is the email name. "Robert Chen" on LinkedIn may well be bob.chen@ in the corporate directory. Nicknames, middle names, maiden names, anglicised names and cultural naming order all break naive derivation. If a derived address fails verification, try the obvious variants before you discard the person.
  • Ignoring the acquisition. A company acquired two years ago may still have profiles pointing at the old domain while all mail now routes to the parent. The address derives cleanly and bounces every time. Check the MX record, not just the pattern.
  • Trusting a single pattern for a large company. Big organisations that have merged frequently run two or three patterns simultaneously, split by the era in which the employee joined. One verified address does not prove the pattern for everyone.
  • Confusing the profile with the person. Many senior people have profiles they have not looked at in three years. An abandoned profile is not a signal that they left; it is a signal that they do not use LinkedIn, which tells you the channel is wrong, not the target.
  • Skipping the verification because the list is small. The reasoning here is exactly backwards. On a small list, every address matters more, and a single bounce is a larger share of your sending reputation.

What to do when the address genuinely cannot be found

Sometimes there is no address. The company hides everything behind a form, the domain is a catch-all so derivation cannot be confirmed, and the person publishes nothing.

The options, in order of how well they actually work:

  1. Use the contact form. Genuinely underrated. Forms are read — often by someone whose entire job is routing them — and a well-written form submission addressed to a named person gets forwarded surprisingly often. It also demonstrates that you respected the route they chose to offer.
  2. Go around, not through. The address of a colleague in a different department, obtained legitimately, gives you the pattern, and it also gives you an internal referral if you ask for one honestly.
  3. Use a channel they actually chose. If someone posts constantly on LinkedIn and never publishes an email address, they have told you which channel they prefer. A thoughtful reply to something they wrote is not a workaround; it is listening.
  4. Accept that they are not reachable and spend the effort on someone who is. This is the option nobody takes, and it is frequently the right one. Prospecting is a portfolio, and forcing a difficult contact costs more than moving on.

What not to do is guess an address at a catch-all domain and send anyway. That is not persistence; it is a bounce with extra steps, and it is charged to your sending reputation rather than to your patience.

The thing nobody wants to hear

The reason people want to scrape LinkedIn is that they want volume. The reason volume does not work is that the response rate to a generic email has been falling for a decade and is now approximately zero.

Ten thousand derived, unverified addresses, sent a template, will produce a handful of replies, a pile of bounces, a damaged domain, and possibly a ban. Two hundred verified addresses at companies you chose deliberately, each written to by someone who read their profile, will produce more meetings — from a list one-fiftieth the size.

The maths is not close, and it has not been for years. Everyone knows this and almost nobody acts on it, because the second approach requires doing the reading and the first one only requires buying a tool.

The tools help. They should help with the parts that are genuinely mechanical — the pattern derivation, the verification, the enrichment — and leave you the part that is not, which is deciding who is worth writing to and what to say. That is the division of labour that works, and it is the one the Govarova extension is built around.

The fastest version of this runs while you browse: the Govarova extension pulls verified emails straight from a profile. Start free to try it.