Work Email Finder: Find Email by Name & Domain (No SMTP)

This work email finder takes a person's name and a company domain and returns the most likely work email, without sending any email and without SMTP probing. It reads the company's own public pages, learns which email format the company really uses (first.last, flast, first...), checks the domain's MX records, and then writes the person's name in that format. Use it to find work email addresses for lead lists, outreach and CRM enrichment. Every result says how sure it is (high, medium, low) and which published addresses it is based on.

The result is a pattern-based likely address. It is never verified: nothing is sent, no mail server is contacted, and deliverabilityVerified is always false. Verify addresses with your own tools before you send.

How to find work email by name and company domain

1. Add people to People: first name, last name and the company domain (or website). A full name works too, and so does a website URL, which is turned into a domain.
2. Run it. Each distinct company domain is read once (a few public pages), however many people work there.
3. Download one row per person as JSON, CSV or Excel, or read it through the Apify API.

What the work email finder does

• Learns the format from public evidence. It reads the homepage plus a few contact, team, about, careers or imprint pages, extracts the email addresses the company published (mailto links, visible text, simple obfuscations like name [at] company [dot] com), and works out the dominant local-part pattern.
• Names are normalised first. Accents (José, Müller, Søren, Łukasz), hyphens (Anne-Marie), particles (van, de la), titles and suffixes (Dr., Jr., PhD), Last, First order and nicknames in brackets are handled. Spelling variants are listed as alternates.
• Checks the domain. DNS MX lookup only (dnspython). A domain without MX records gets no address. A lookup that fails or times out is reported as unknown (mxOk: null), not as "no mail".
• Rejects non-company domains. gmail.com, outlook.com, yahoo.com and other free-mail or disposable domains return a clear reason instead of an address.
• Always one row per person. Even when nothing is found you get a row with a reason, so lists stay aligned. Use inputIndex or your own id to join back.
• Polite and safe. robots.txt is respected, requests are spaced out, a few pages per domain are read with short timeouts, and the crawler refuses localhost, private networks, link-local and cloud-metadata addresses, also through DNS tricks and redirects.

Confidence levels

Confidence	Meaning	Charged
high	The pattern is used by 2 or more personal addresses the company published on its own domain, or this exact address is published on its site.	yes
medium	Exactly 1 published personal address supports the pattern.	yes
low	A common-pattern guess (no usable evidence, role mailboxes only, or conflicting patterns). Marked clearly, with the reason.	no
none	No address: free-mail or disposable domain, domain without MX records, or unusable input.	no

Role mailboxes (info@, support@, sales@, hello@, press@, careers@...) are never used as evidence for a personal pattern. Addresses on subdomains such as lists.company.com are listed but not used as evidence either, and a hyphen alone (public-webapps@) is not treated as a name pattern.

Input example

{
  "people": [
    {"firstName": "Jane", "lastName": "Doe", "domain": "acme.com", "id": "lead-1"},
    {"fullName": "Dr. Omar Haddad Jr.", "website": "https://www.acme.com/about"},
    "Anne-Marie Dubois | example.org"
  ],
  "maxPagesPerDomain": 6,
  "evidenceMode": "masked"
}

Each person accepts firstName, lastName (or fullName), domain (or website / companyUrl) and your own id. A string "Name | domain" also works.

Output example

{
  "inputIndex": 0, "id": "lead-1", "firstName": "Jane", "lastName": "Doe", "domain": "acme.com",
  "email": "jane.doe@acme.com", "confidence": "high", "pattern": "first.last", "publishedOnSite": false,
  "mxOk": true, "mxHosts": ["aspmx.l.google.com", "alt1.aspmx.l.google.com"], "mailProvider": "Google Workspace",
  "deliverabilityVerified": false,
  "alternates": [{"email": "jdoe@acme.com", "pattern": "flast"}, {"email": "jane@acme.com", "pattern": "first"}],
  "evidence": {"patternSupport": 3, "supportingAddresses": ["j***.s***@acme.com", "m***.g***@acme.com"],
               "pages": ["https://acme.com/contact", "https://acme.com/team"]},
  "pagesChecked": 4,
  "reason": "Pattern first.last is used by 3 published addresses on acme.com; the address is derived from the name, not confirmed to exist.",
  "charged": true, "error": null
}

• email is the best guess and alternates lists other likely addresses (other patterns, spelling variants, common patterns).
• evidence.supportingAddresses are masked by default (j***.s***@acme.com) so you can check the source page without copying other people's addresses. Set Published addresses in the evidence to full to see them as published.
• A SUMMARY record in the key-value store counts results by confidence and charged results.

Email pattern finder: learn the format of a whole domain

Set Mode to email-pattern and list company domains. For each domain you get the dominant pattern, every pattern seen with its support, the published addresses (role mailboxes in full, personal ones masked unless you ask for full), the pages read, the MX hosts and the mail provider. Use it to prepare your own outreach lists, or to check a pattern before you run the people mode.

{"mode": "email-pattern", "domains": ["acme.com", "https://www.example.org/contact"]}

Work email finder API

Call it from the Apify API, Python, JavaScript, Make, Zapier or n8n. Example with the Apify Python client:

from apify_client import ApifyClient

run = ApifyClient("<APIFY_TOKEN>").actor("data-done-right/work-email-finder").call(run_input={
    "people": [{"firstName": "Jane", "lastName": "Doe", "domain": "acme.com"}]})
for row in ApifyClient("<APIFY_TOKEN>").dataset(run["defaultDatasetId"]).iterate_items():
    print(row["email"], row["confidence"], row["pattern"])

Use it in Claude, ChatGPT and Cursor

Connect Apify's MCP server (mcp.apify.com) and your AI assistant can look up work emails itself. For example: "find the likely work email for Jane Doe at acme.com and tell me how confident it is and why." The main input is people; mode: "email-pattern" with domains returns the learned format of a domain.

How much does it cost

Pay per event, with no per-run start fee:

• $0.002 per result (email-found), charged only for high and medium confidence rows. low and none rows, unusable input and bad domains are free. 1,000 charged results cost about $2.
• $0.003 per domain (domain-pattern) in email-pattern mode, charged only when a pattern was learned from published addresses.

Paid Apify plans get 10% (Silver) to 20% (Gold and up) off. Other work email finders on Apify charge about $0.003 to $0.005 per found email; this one is priced below that because it verifies nothing and its low-confidence guesses are free. maxPeople caps the bill, and if you set a maximum spend per run the Actor stops cleanly when it is reached and keeps the results already delivered.

Responsible use

• You decide whether you may email someone. Finding a likely address is not permission to use it. In the EU and UK, B2B outreach needs a documented legitimate interest (GDPR Art. 6(1)(f)) and a way to object; some countries require prior consent. In the US, CAN-SPAM requires honest headers, a physical address and a working opt-out. CASL (Canada) and other laws are stricter.
• Respect opt-outs. Keep a suppression list and honour unsubscribe requests and "do not contact" signals.
• No harvesting of personal addresses. The Actor does not build lists of addresses. It learns a company's format and applies it to people you name. Masked evidence is the default so the other people's published addresses are not copied out.
• Business domains only. Free-mail and disposable domains are rejected, so you do not guess private mailboxes.
• Verify before sending. A pattern guess can be wrong, and a wrong guess can reach a different real person. Run your own verification and keep bounce rates low.
• Only public pages are read, robots.txt is obeyed, and the crawl is slow and small on purpose.

Honest limits

• Not verified, ever. No SMTP check, no mailbox probe, no catch-all detection. Outbound mail ports are unreliable on cloud platforms and probing mail servers is intrusive, so this Actor does neither. deliverabilityVerified is always false.
• Evidence needs published addresses. Many companies publish only role mailboxes (info@, support@). Then you get a low common-pattern guess, which is free and marked as a guess.
• Compact addresses are ambiguous. jsmith@ could be flast or a nickname. It only counts as evidence when a name is printed next to it on the page.
• Companies mix formats. Large companies often use different formats per team or acquired brand, and aliases can exist next to the main address. The pattern describes the most common published format.
• Names: non-Latin names (for example Chinese or Arabic script) need a Latin spelling. Very common names may collide with another person at the same company.
• Websites can block or hide emails. JavaScript-only pages, forms instead of addresses and bot blocking mean less evidence. Cloudflare-protected addresses are decoded, other obfuscation is not.
• Domains: the subdomain you give is used as is (eu.acme.com is not shortened to acme.com). A domain with only an address record and no MX is treated as unable to receive mail.

FAQ

How do I find a work email by name?

Give the first name, last name and company domain (or website). The Actor learns the company's email format from its public pages and writes the name in that format. Check confidence and reason to see how well it is supported.

Does it send emails or check the mailbox?

No. Nothing is sent, and no mail server is contacted. It does a DNS MX lookup and reads public web pages. That is why the results are labelled as likely addresses and never as verified.

Why do I get a low confidence result?

The company publishes no personal addresses that show a pattern (or the patterns conflict), so the Actor falls back to the most common format, first.last. These rows are free. Treat them as a starting point and verify them.

Can it find a personal Gmail or Outlook address?

No. Free-mail and disposable domains are rejected on purpose. It is a work email finder for company domains.

What is the email pattern finder mode?

It takes only domains and returns the format the company uses (for example first.last) with the published addresses it comes from, so you can see the evidence yourself.

What is the difference to email verifiers?

Verifiers contact the mail server to test a mailbox. This Actor does not, so it is cheaper and does not touch anyone's mail server, but it cannot tell you the address exists. A common workflow is to use this Actor to generate the likely address and your own verifier to confirm it.

Does it respect robots.txt?

Yes. A Disallow for the bot is obeyed, a Crawl-delay slows it down (up to 10 seconds), a 4xx on robots.txt means no restrictions, and a 5xx or an unreachable robots.txt means the site is skipped.

Are results charged when nothing is found?

No. Only high and medium rows are charged. Rows with low or none confidence and rows with unusable input are free, and every person still gets a row.

Related tools

• Company Enrichment API: Domain to Tech, Jobs & Socials: add tech stack, jobs and social profiles to the same domains.
• Hiring Signals: Tech Stack & Headcount Growth from Job Posts: find companies that are hiring and growing.
• Google Sheets Import & Export: Apify Data, No Login: send the results to a Google Sheet.