Can I just guess first.last@company.com?

You can generate it, but do not send to it unverified. The pattern is common enough that a guess has a reasonable chance, and common enough that a wrong guess bounces. One verification step turns probability into a usable address.

What does a catch-all result mean?

The domain's server accepts mail for any local part, so it cannot tell you whether the mailbox exists. Everything at that domain is uncertain. Some senders include catch-all addresses in later campaigns once reputation is established; others exclude them permanently.

Is it legal to email an address I found on a company site?

Rules vary by country and by whether the recipient is a business or a consumer. A published business address is generally the most defensible kind of cold contact, but it is not universal consent. Include a working opt-out and honour it, and check the rules that apply where you and the recipient are.

How current does verification need to be?

Re-verify before each campaign that uses an older list. Addresses are removed continuously, and a list verified a year ago carries a hidden bounce rate. Anything you have not contacted in six months should be treated as unverified.

Finding a Company's Email Addresses From Its Domain

The short answer

You can infer a company's email pattern from one known address, then verify each guess against the domain before using it. Public company pages, press releases and professional profiles supply the known addresses. Guessing alone is not enough: unverified guesses bounce and damage the sending domain.

A domain tells you the pattern, not the people. The work is to find one real address at the company, infer the pattern from it, and then verify the candidates rather than sending to all of them. Doing it in that order is what separates a usable list from a bounce rate that gets an account suspended.

Get one real address before guessing

The company site, contact and team pages, press releases, tender documents and professional profiles all publish addresses. One is enough to establish the pattern: first.last@, first@, flast@, or first_last@. Large companies often run several patterns, so a second known address improves confidence considerably.

Where no address is published, the domain still constrains things. A Microsoft 365 or Google Workspace tenant can be detected from its MX records, which tells you it is a real corporate domain and usually that verification will be possible, but not what the local parts are.

Build candidates, then verify them

Generate the plausible local parts for the people you care about, then verify: syntax, MX, and a mailbox-level check. Verification is the step that turns a guess into a usable address, and it is also how you learn which pattern the company actually uses before you have committed to a campaign.

Expect a share of guesses to fail even at companies where you know the pattern, because people use middle names, initials or department aliases. That is normal and is why the verification step is not optional.

Find one published address to establish the pattern.
Generate candidates for the roles you actually need.
Verify each candidate; keep only the mailbox-valid ones.
Prefer a named person over info@ for cold outreach.
Record the source and the verification date against each address.

What not to do

Do not send to every permutation to "see which bounces". The bounces are the damage: they hit your domain reputation and the provider's, and a five percent guess campaign can cost a week of recovery. Verify first, send to what verified.

Do not treat a catch-all domain as verified. If every guess returns uncertain, you have learned that the server accepts anything, not that the addresses exist. Sending to catch-all guesses is a decision with a predictable complaint rate, not a discovery method.

Worked example: 600 guesses, 210 real addresses

A recruiter wanted to reach hiring managers at 200 companies and had names from job adverts but no addresses. The MX records showed all 200 domains used one of two corporate mail providers, so verification would be possible. One published address from a press release established the first.company pattern at one firm; a team page at another established firstlast.

Six hundred candidates were generated from the names and verified against each domain. About 210 came back valid, 300 were unknown users and 90 were catch-all and therefore uncertain. The recruiter sent to the 210, kept the 90 separate, and ignored the rest.

The reply rate was ordinary, and the bounce rate was under two percent, because nothing unverified was sent. The alternative, sending to all 600 to find out, would have produced roughly 300 bounces and a suspension at any responsible provider.

Source, what it gives you, and the catch

Source	What you get	Reliability	Catch
Company contact and team pages	Real published addresses	High	Often role addresses only
Press releases and filings	Named press or legal contacts	High	May be an agency address
Professional profiles	Name, role, sometimes address	Medium	Address often absent
Pattern inference plus verification	Named addresses at scale	Medium to high	Pattern may vary by department
Purchased list	Volume	Low without verification	Bounces and consent problems

MX records tell you where a domain receives mail, not who works there. Useful for verification planning, not for naming people.

A repeatable method

1Check the MX records to confirm the domain receives mail somewhere real.
2Find at least one published address at the company.
3Infer the pattern and generate candidates for the roles you need.
4Verify every candidate before it enters a campaign.
5Record source and verification date so stale addresses can be found later.

Where this connects on this site

For the discovery step in one place, use lead and contact discovery
Once the list is verified, you need sending accounts
To confirm a domain accepts mail for a mailbox, try the SMTP tester

What this will not do

A verified address is not consent, and relevance still decides whether anyone replies.
Catch-all domains cannot be verified and remain a judgement call.
Patterns change when a company renames people or moves to a new system, so addresses go stale.
No method guarantees coverage; some companies publish nothing and accept no external mail beyond a form.

Questions this page gets asked

Can I just guess first.last@company.com?: You can generate it, but do not send to it unverified. The pattern is common enough that a guess has a reasonable chance, and common enough that a wrong guess bounces. One verification step turns probability into a usable address.
What does a catch-all result mean?: The domain's server accepts mail for any local part, so it cannot tell you whether the mailbox exists. Everything at that domain is uncertain. Some senders include catch-all addresses in later campaigns once reputation is established; others exclude them permanently.
Is it legal to email an address I found on a company site?: Rules vary by country and by whether the recipient is a business or a consumer. A published business address is generally the most defensible kind of cold contact, but it is not universal consent. Include a working opt-out and honour it, and check the rules that apply where you and the recipient are.
How current does verification need to be?: Re-verify before each campaign that uses an older list. Addresses are removed continuously, and a list verified a year ago carries a hidden bounce rate. Anything you have not contacted in six months should be treated as unverified.

Last reviewed 2026-10-27. Written for readers in the United States and elsewhere; rules about access, email and consent differ by country, and nothing on this page is legal advice.