LinkedIn Email Finder

LinkedIn Email Finder takes a LinkedIn profile URL and gives back the person's name, current title, company, location — and their work e-mail address, with the mailbox verified by an SMTP check, plus the evidence behind it. Paste one URL or a thousand; one row per profile.

$0.01 per verified e-mail ($0.0232 from 15 October 2026). The mailbox is verified by an SMTP check (no e-mail is sent), and you are charged only when it is verified. Catch-all domains (the mail server accepts any address) are returned unverified and not charged as an e-mail. A profile that cannot be read, a person whose company has no findable website, an address on a domain that takes no mail, a mailbox that does not exist — all free. No LinkedIn login, no cookies, no browser, no API key.

What is LinkedIn Email Finder?

It is the step between "I found them on LinkedIn" and "I wrote to them". The Actor reads the public profile page — the same page a search engine sees, no login — for the name and the current position. It then turns the company into its website, reads how that company writes its addresses (a team page that says jane.doe@ tells you how everyone else is addressed), builds the person's address in that layout, checks that the mail domain accepts mail and then verifies the mailbox by an SMTP check — the address published on the site or built on the company's own layout first, then the most likely layouts, at most 2 checks per person, stopping at the first mailbox that exists.

The answer is never a bare guess dressed up as a fact: every row says whether the address was published on the company site, whether the layout was confirmed there, or whether it is the common-layout fallback — and prices only the rows whose mailbox is verified.

What is in every row

Field	Meaning
fullName, title, company, headline, location	From the public profile
positions, education, companyLinkedinUrl, imageUrl	Current positions with start dates, schools, the company page
otherCurrentCompanies, companyChosenBy	When a person has several current jobs, company is the main one — named in the headline (or, when LinkedIn hides the headline, in the About text / profile website), then founder / CEO level, then the longest-held; the other current companies are in otherCurrentCompanies, and companyChosenBy says why. If the main company's mail server accepts any address, one check goes to the next current company (emailCompany says where the e-mail is)
email, emailPattern, confidence	The address — only a mailbox verified by the SMTP check — the layout it follows (first.last, flast, first…) and verified (without a mailbox check: confirmed / high / medium / low)
emailVerified, emailCatchAll, emailVerification	true — the mailbox exists; false — checked, not confirmed; null — not checked. emailCatchAll: true — the domain accepts any address, nothing can be confirmed. emailVerification — status (safe, catch_all, unknown, invalid…), score, time and every address tried
emailGuess	The best unverified address when it is not put into email (catch-all domain, mailbox not confirmed, or the domain failed the DNS check) — free, use at your own risk
foundOnSite, patternEvidence, patternEvidenceCount	Whether the address itself is on the company site, and which published addresses show the layout
alternatives	Runner-up addresses in the other plausible layouts
emailStatus	What was really checked: mailbox-verified; catch-all, mailbox-unknown, mailbox-invalid (not charged); undeliverable / risky / unknown when the mail domain fails the DNS check. Without a mailbox check (only if it is unavailable in a run): found-on-website, pattern-confirmed, unverified-guess
emailDomainStatus, emailProvider, emailMxHost, emailIsRole, emailIsFree	Mail-domain checks: accepts-mail / risky / undeliverable / unknown, which provider (Google Workspace, Microsoft 365…)
domain, domainSource, domainEvidence, summary	The company website, how it was confirmed as the company's, and a one-line explanation

How much does it cost?

$0.01 per verified e-mail — one row with a verified address, one charge, no start fee. From 15 October 2026 the price is $0.0232 per e-mail found (lower on Apify's higher discount tiers); still nothing for profiles without a verified address.

When exactly is the e-mail price paid? Only when the row's email is filled, which needs all of: a domain confirmed as the company's, a DNS check showing the domain accepts mail, and the mailbox verified by the SMTP check (emailVerified: true).

emailStatus	What it means	Charged?
mailbox-verified	the mailbox exists (SMTP check)	yes
catch-all	the domain accepts any address — no mailbox can be confirmed; the address is in emailGuess	no — free
mailbox-unknown / mailbox-invalid	the server would not say / no mailbox for the checked layouts	no — free

Measured on 10 public profiles of founders and executives (9 October 2026): 7 of 10 mailbox-verified e-mails, 2 SMTP checks per verified address on average; the other 3 were on catch-all domains and came back free in emailGuess.

If the mailbox check is unavailable in a run, the evidence rules below apply instead, and summary says so:

confidence	emailStatus	What was checked	Charged by default?
confirmed	found-on-website	the address itself is published on the company website	yes
high	pattern-confirmed	two or more personal addresses on the company site use this layout	yes
medium	pattern-confirmed	one personal address on the company site uses this layout	yes
low	unverified-guess	nothing: the most common layout (first.last) on a domain that accepts mail	no — free, in emailGuess
unusable	undeliverable / risky / unknown	the mail domain failed the DNS check	no — free

Set Minimum e-mail confidence to low to have common-layout guesses in email and pay for them as found e-mails (the behaviour before 5 October 2026, when such guesses were labelled deliverable).

• Profiles that cannot be read or do not exist: $0.
• People whose company has no website we can find: $0 (the profile data is still delivered).
• Addresses on a domain that does not accept mail, has no MX record, or does not answer a DNS check after three tries: $0 (reported as unusable, the guess kept in emailGuess and alternatives when the domain merely did not answer or has no MX).
• Addresses whose mailbox is not verified (catch-all, unknown, invalid): $0, the guess kept in emailGuess.
• Input values that are not LinkedIn profile URLs: $0, an error row says why.
• Profile data, alternatives, evidence and domain checks: included.

How profiles are read

Every LinkedIn profile is read through a residential address, a new one for each profile, because LinkedIn starts refusing direct and datacenter requests after a few dozen profiles. About one profile in five is hidden from logged-out visitors on that route (LinkedIn answers HTTP 999 or shows a login wall). Hidden profiles are opened through a second route: a web unblocker first, and a heavier unblocking service for the ones it cannot open — together they open most of them. The second route is paid from the run's own margin, so on a list where few profiles end in a charged e-mail some hidden profiles may not get it. Both routes are included in the price; a profile that still does not open is an error row and costs nothing. Company websites are read directly. If you put your own proxy URLs in the proxy field, they are used for LinkedIn and the second route is off.

Very long lists

When most of the last 30 profiles in a run are refused by rate limits (hidden profiles do not count), the rest of the list goes straight to the second route (with your own proxies: the run pauses for 90 seconds, and after two pauses stops). A run that gets within 45 seconds of its timeout stops taking new profiles the same way. Profiles that were not tried are not charged; their URLs are saved in the NOT_ATTEMPTED record of the run's key-value store and named in the status message, so you can run them again later.

Run health

When a run ends with many error rows, the Actor sends its developer the counts (rows delivered, error types, run ID) so the cause gets fixed fast. Your input and your results are never sent.

Bulk export: what 50,000 rows actually cost

This Actor is built for bulk jobs — put a whole search export into one run, or call it from the API for every new lead. There is no fee per run, no fee per profile and no proxy charge: you pay for the e-mails you get. That is what decides the bill once you enrich a whole list rather than a handful.

Job	This Actor	Most-used Actor in this category
50,000 e-mails across 100 runs	$500 ($1,160 from 15 October 2026)	$1,450 + start fees

Checked on the Apify Store on 23 September 2026 against the Actor with the most monthly users in this category ($0.029 per e-mail plus a fee per run). Some Actors here ask less per row — this table compares against the one buyers actually use most.

How to use it in three steps

1. Paste profile URLs into 🔗 LinkedIn profile URLs, one per line — or link a sheet under 📄 Profile URLs from a file or sheet.
2. If every profile is from one company, or a company name will not resolve to a website, type the domain into 🏢 Company override.
3. Press Start, then download JSON, CSV or Excel — or call the run from the API, n8n, Make, Zapier or an AI agent.

⬇️ Input

{
  "profileUrls": [
    "https://www.linkedin.com/in/patrickcollison",
    "https://www.linkedin.com/in/satyanadella"
  ],
  "candidatesPerPerson": 3
}

⬆️ Output

{
  "type": "person",
  "linkedinUrl": "https://www.linkedin.com/in/ondra-urban",
  "fullName": "Ondra Urban",
  "title": "COO",
  "company": "Apify",
  "location": "Prague, Czechia",
  "domain": "apify.com",
  "email": "ondra@apify.com",
  "emailVerified": true,
  "emailCatchAll": false,
  "emailPattern": "first",
  "confidence": "verified",
  "alternatives": [{ "email": "ondra.urban@apify.com", "pattern": "first.last" }, { "email": "ourban@apify.com", "pattern": "flast" }],
  "emailGuess": null,
  "emailStatus": "mailbox-verified",
  "emailVerification": { "provider": "reoon", "status": "safe", "score": 98, "checks": 2, "tried": [{ "email": "ondra.urban@apify.com", "status": "invalid" }, { "email": "ondra@apify.com", "status": "safe" }] },
  "emailDomainStatus": "accepts-mail",
  "summary": "ondra@apify.com: the mailbox was confirmed by an SMTP check.",
  "scrapedAt": "2026-10-09T08:21:04.786Z"
}

Use cases

Outbound from a LinkedIn search

Export the profile URLs from a search or a Sales Navigator list, run them through, and load the rows with emailVerified: true into your sequencer.

Enriching a CRM

A webhook per new lead: LinkedIn URL in, name, title, company and e-mail out, straight into the contact record.

Recruiting

Candidates' current company and a work address for the first touch, without buying a seat in a data tool.

AI agents

Connect through the Apify MCP server and ask "find a work e-mail for linkedin.com/in/…" — the agent gets a row with the address, the layout and the evidence.

Integrations

Every run is available through the Apify API, and the Actor works out of the box with n8n, Make, Zapier, Google Sheets, LangChain and the Apify MCP server. Schedule it, webhook it, or export straight to CSV.

FAQ

Does it log in to LinkedIn? No. It reads the public profile page, which needs no account. Some profiles hide details from anonymous readers; those still return the name and, usually, the company from the page title.

Is the address verified with the mail server? Yes: the mailbox is verified by an SMTP check (no e-mail is sent), and you are charged only when it is verified. Catch-all domains (the server accepts any address) are returned unverified with emailCatchAll: true and not charged — no service can confirm a person's mailbox there.

Why is email empty but emailGuess filled? The mailbox could not be verified — usually a catch-all domain, sometimes a server that will not say. The best address is in emailGuess, free; emailVerification shows what was checked.

What if the company name does not resolve to a website? The row comes back free with the profile data and a note; pass the domain in Company override and run again.

How do you know the domain is really the company's? An address is built only on a domain with evidence: you gave it, it is the parent's mail domain (Microsoft AI → microsoft.com), the company's LinkedIn page links it, the domain spells the company name, or the website carries the company's name. A look-alike domain that passes none of these is listed in unconfirmedDomains, no address is built on it, and the row is free. Titles and credentials in names (Dr., Gov., PhD, MBA, Jr., emojis, text after a comma or a pipe) are removed before the address is written. A middle name is never glued into the address: "Martin Luther King" is written as martin.king@, while a surname with particles stays whole ("van der Berg", "de la Cruz").

Is this legal? The Actor reads public pages and public company websites and constructs a business address in the company's own layout. Use it for business contact in line with GDPR, CCPA and the sites' terms; respect opt-outs.