How to Find Email Addresses from a List of Domains
On this page
The Problem
You have a list of company domains. Maybe from a conference attendee list, a directory, an industry database or your own research. You need email addresses for people at those companies. The domains alone are not enough to start outreach.
Here are practical methods to turn domains into deliverable email addresses.
Method 1: Scrape the Website
Company websites often contain email addresses in plain text, especially on contact pages, about pages, team pages, footer sections and press pages.
Manual approach:
- Visit each domain.
- Check the contact page, about page, team page and footer.
- Copy any email addresses you find.
Automated approach:
- Save the relevant pages as HTML files.
- Upload them to Email Extractor.
- Click "Extract emails."
- Download the deduplicated list.
You can also use Email Extractor's webpage extraction feature to process URLs directly.
Advantages: The addresses are published by the company itself, so they are current and intentionally public.
Limitations: Many companies do not list individual email addresses on their website. You may find generic addresses (info@, contact@, sales@) rather than personal ones.
Method 2: Email Pattern + Name Lookup
Most companies use a consistent email format. If you can identify the pattern and a person's name, you can construct their address.
Step 1: Find the pattern.
- Search for any known email from the domain. Check press releases, job postings, GitHub profiles, author bios, WHOIS records or SEC filings.
- Tools like Hunter.io offer a domain search that reveals the email pattern.
Step 2: Find the person's name.
- LinkedIn is the most reliable source for current employee names and titles.
- Company about/team pages also list staff.
- Industry directories and conference speaker lists are other sources.
Step 3: Construct the address.
- Apply the pattern to the name. If the pattern is firstname.lastname@company.com and you need to reach Sarah Jones, try sarah.jones@company.com.
Step 4: Verify the address.
- Before sending, verify using an MX record lookup and SMTP check, or use a verification service. See How to Check If an Email Address Is Valid.
Advantages: Works for any employee at the company once you know the pattern.
Limitations: Patterns can vary within a company (executives may use a different format). Common names may have variants (Mike vs Michael). Verification is essential.
Method 3: B2B Data Providers
Data providers maintain databases of business contact information indexed by domain, company, title and industry.
How it works:
- Upload your list of domains.
- The provider matches each domain to their database.
- Results include contact names, titles and email addresses.
Common providers: Apollo.io, Hunter.io, Snov.io, ZoomInfo, RocketReach, Lusha, Clearbit, Seamless.AI and UpLead.
Advantages: Fast. Can process hundreds or thousands of domains at once. Many providers include verification.
Limitations: Coverage varies. Not every domain will have contacts in the database. Accuracy is imperfect, and data goes stale. Free tiers have limited lookups.
For platform-specific guides:
- Extract Emails from Apollo.io Contacts
- Extract Emails from Hunter.io Leads
- Extract Emails from Snov.io Contacts
Method 4: Google and Search Operators
Google indexes a surprising number of email addresses. Using search operators can surface addresses associated with specific domains.
Useful queries:
"@company.com"-- finds pages containing email addresses from that domain.site:company.com "email" OR "contact"-- finds contact pages on the company's own site."company.com" filetype:pdf-- finds PDF documents from the company, which may contain author emails."@company.com" site:linkedin.com-- finds LinkedIn profiles that display email addresses from that domain.
Processing results:
- Copy the search result text.
- Paste into Email Extractor.
- Extract the email addresses.
For more on search techniques, see Google Search Operators for Email Finding.
Advantages: Free. Can find addresses not available through data providers.
Limitations: Time-consuming for large domain lists. Not all domains have indexed email addresses. Results may include outdated addresses.
Method 5: Public Records and Filings
Government filings, regulatory databases and public records often contain email addresses tied to specific companies.
Sources:
- SEC filings (for US public companies).
- Patent databases (inventor contact information).
- Government contract databases (contractor points of contact).
- Non-profit filings (IRS Form 990 for US non-profits).
- Business registration databases (varies by country and state).
Download relevant filings as PDFs or text files and process them through Email Extractor.
Processing at Scale
For a list of 10 domains, manual methods work. For 100 or more, you need a systematic approach.
Batch workflow
- Start with a B2B data provider for broad coverage.
- For domains with no results, try pattern guessing with name lookups.
- For remaining gaps, use website scraping and search operators.
- Consolidate all results into a single file.
- Run through Email Extractor to deduplicate.
- Verify the full list through a verification service.
Prioritise by value
Not all domains on your list are equally important. Prioritise high-value targets for manual research and use automated tools for the rest.
After Finding the Addresses
Verify before sending
Addresses from any source should be verified. See Best Email Verification Services.
Check compliance
If your targets include EU residents, GDPR applies. If Canadian, CASL applies. Understand your obligations before sending. See GDPR Guide and CAN-SPAM Guide.
Segment by source quality
Addresses from company websites are higher quality than pattern guesses. Segment your list by source and adjust your outreach approach accordingly.
