LinkedIn Email Finder — Profile URL to Email (No Login)

What you get

Generate likely work email addresses from LinkedIn profile URLs or name-and-domain pairs. No login, cookies, or Sales Navigator seat. Every result includes ranked candidates and an explicit confidence/verification status so an inferred address is never presented as guaranteed.

Works inside Claude, ChatGPT, and any MCP-compatible agent via the Apify connector. Pairs cleanly with LinkedIn Employees Scraper — run that first to build a target list, then this to fill in emails.

Two input modes

Mode 1 (recommended): Direct contacts

Best for high-volume prospecting. Provide name + domain and the actor skips LinkedIn entirely. Name + company also works; add the company's companyLinkedinUrl or website when you have it, because a company name shared by several businesses is returned unresolved rather than guessed. This is the right path when chaining from LinkedIn Employees Scraper — that actor outputs name + company already.

{
  "contacts": [
    {"firstName": "Jane", "lastName": "Doe", "domain": "stripe.com"},
    {"fullName": "John Smith", "company": "Acme Inc", "companyUrl": "https://acme.com"}
  ]
}

Mode 2: Profile URLs (best-effort)

Supply LinkedIn profile URLs. The actor fetches each public profile for name + current employer, then reads the employer's website from its LinkedIn company page. If LinkedIn blocks the profile, or the employer's website can't be confirmed, the lookup comes back with status: "unresolved" and no email (free, in the no-email dataset) — never a guessed domain. Use domainOverride to guarantee a usable domain when you already know it.

{
  "profiles": [
    "https://www.linkedin.com/in/jane-doe-12a/",
    "https://www.linkedin.com/in/jsmith-acme/"
  ],
  "domainOverride": "stripe.com"
}

How it works

1. Extract name + company — from the candidate's public LinkedIn profile page (no login needed)
2. Resolve domain (evidence only) — the website listed on the person's own employer page on LinkedIn (from their profile, or a companyLinkedinUrl you supply). With a company name alone, the domain is used only when LinkedIn lists exactly one company by that name and its website matches the name; names shared by several companies come back unresolved rather than guessed. LinkedIn, social, link-shortener and free-mail hosts are never used as an email domain
3. Generate candidates — 12 common B2B patterns weighted by real-world frequency: first.last, first, flast, firstlast, f.last, firstl, last, etc. Credentials (, MBA), nicknames and double first names are cleaned first
4. Verify (optional) — with verifyEmails on, candidates are checked at the mailbox level in frequency order (up to 6 per person). The search stops at the first confirmed mailbox; a catch-all domain stops after one check; addresses the mail server rejects are never returned
5. Rank — verified > catch_all > pattern

What you're charged for

Only rows that come back with an email address (primaryEmail is filled) are charged. That covers verified, catch-all, mailbox-full and unverified pattern matches; the confidence field tells them apart. Lookups that return no email are free, such as an unavailable profile, an employer whose domain could not be confirmed, a rejected domainOverride, or a domain where every candidate was rejected by the mail server.

Rows with an email go to the run's default dataset. Lookups without an email go to a separate, unbilled dataset, so you can still see what happened to each contact. If you set a maximum charge for the run, the actor never runs more lookups at once than the remaining budget can pay for, and stops looking up new contacts once the budget is used up.

Finding lookups without an email

Each run writes a summary to its key-value store under the OUTPUT key (the Run summary link in the run's Output tab). It contains:

Field	Meaning
emailsFound	Rows in the default dataset (the billed results)
noEmail	Lookups that returned no email (free)
noEmailDataset.itemsUrl	API link to the free dataset with those lookups. Append &token=<your API token> if your storage is private
noEmailDataset.consoleUrl	The same dataset in Apify Console
notProcessedChargeLimit	Contacts not looked up because the run's maximum charge was reached
mailboxVerification	When verifyEmails is on: mailbox checks completed (creditsUsed) and failed (failures) in this run

Rows in the free dataset have the same fields as the default dataset, with primaryEmail empty and the reason in unresolvedReason or confidence. Through the API, read the OUTPUT record from the run's default key-value store, then fetch noEmailDataset.itemsUrl.

Output

Field	Description
fullName	Person's name
firstName / lastName	Parsed name parts
company	Current employer (from LinkedIn)
status	resolved, or unresolved when no email could be honestly derived
unresolvedReason	profile_unavailable / employer_unknown / employer_domain_unresolved / employer_name_ambiguous (several companies share the name: add domain or companyLinkedinUrl) / name_missing / invalid_domain_override
domain	Employer email domain (empty when unresolved)
domainSource / domainEvidence	Where the domain came from (input, override, linkedin_company_page, company_name when the company name is itself a domain such as ujet.cx) and the URL that backs it
primaryEmail	Best-guess email. Always filled in the default dataset; empty in the free no-email dataset
candidates	All weighted candidates [{email, weight}]
verificationStatus	verified / catch_all / unverified when verifyEmails is on; skipped when it is off
verificationBackend	Which check produced the status: mailbox_api (mailbox-level verification), smtp (basic mail-server check, used when mailbox verification is unavailable) or none
verificationDetail	Why: e.g. mailbox_safe (mailbox confirmed), mailbox_catch_all (domain accepts every address), mailbox_inconclusive (mail server gave no definite answer), mailbox_inbox_full, mailbox_check_failed (the mailbox check could not complete), no_candidate_verified, no_mx, credit_budget_exhausted
verificationAttempts	Each candidate checked and its mailbox result [{email, status, score}]
confidence	verified / catch_all / pattern / pattern_unverified / pattern_no_mx / mailbox_full (mailbox exists but is full, so not deliverable today) / all_candidates_rejected / unresolved
verifiedEmails	Emails confirmed at the mailbox level
mxHosts	Mail servers found via DNS
catchAll	Whether the domain accepts all addresses
profileUrl	Original LinkedIn URL

Verification reality check

With verifyEmails on, each candidate is checked at the mailbox level, without sending any email. A verified row means the mail server confirmed that exact mailbox.

• Catch-all domains accept every address, so no single mailbox can be confirmed. The row returns the most likely pattern with verificationStatus: catch_all.
• Inconclusive servers (greylisting, providers that hide mailbox validity) return unverified with the best remaining pattern.
• If mailbox verification is temporarily unavailable, the affected rows are marked unverified with their best pattern rather than failing the run.

Unverified pattern matches are right roughly 60-70% of the time on real B2B domains. Bounce-test them before mass sending.

Compared to alternatives

Tool	Cost	Login required	Verification
This actor	Pay per email found; lookups without an email are free	No	MX + optional mailbox verification
Hunter.io	$0.049/search	API key	Yes
Apollo	$99/mo seat	Account	Yes
Snov	$0.027/credit	API key	Yes

Tips

1. Pair with LinkedIn Employees Scraper — run it first for prospect lists, then feed profile URLs here.
2. Use domainOverride when LinkedIn shows a parent brand but you want subsidiary emails.
3. Enable verifyEmails when you need confirmed mailboxes. maxVerificationCredits caps the number of mailbox checks per run.
4. Always bounce-test before mass sending — pattern matches without mailbox verification still bounce 30–40% of the time.

Input parameters

Parameter	Required	Description
profiles	No	List of LinkedIn profile URLs (e.g. https://www.linkedin.com/in/username/). The actor fetches each profile to extract name and current company, then derives the most likely work email. Use this OR the 'contacts' field below.
contacts	No	Pre-extracted contacts as objects with firstName, lastName, and either company or domain. These skip the LinkedIn profile fetch entirely (cheaper). You may add linkedinUrl: it is only fetched when the name or the company/domain is missing. Example: [{"firstName":"Jane","lastName":"Doe","domain":"stripe.com"}].
domainOverride	No	Force all lookups to use this domain (e.g. 'stripe.com'). Useful when LinkedIn shows a parent brand but you want subsidiary emails.
verifyEmails	No	Check candidates at the mailbox level, most common pattern first, stopping at the first confirmed mailbox (up to 6 per person).
maxVerificationCredits	No	Upper bound on mailbox checks per run (default 300). Runs from a free Apify plan are limited to 20.
maxResults	No	Cap total profiles processed across all inputs.
proxyConfiguration	No	Connection settings for reading LinkedIn pages. The default works for most runs; leave it as is.

Use cases

• Sales teams building outreach lists
• Agencies sourcing local-business leads
• RevOps teams enriching CRM records

Limitations

• The more you provide, the better the match. A company domain or LinkedIn company URL gives the most reliable results. If a company name matches several businesses (for example, several companies called "Foxglove"), the lookup returns no email rather than guessing. It comes back free, with unresolvedReason: employer_name_ambiguous.
• Some companies accept mail for every address (catch-all). For these, the most likely address is returned with verificationStatus: catch_all, because no mail server can confirm an individual mailbox.
• LinkedIn profiles that require sign-in can't be read. For those people, supply the name and company or domain directly.
• Lookups without an email are free. They are stored in a separate dataset with the reason in unresolvedReason or confidence (see Finding lookups without an email).

Last verified: 2026-10

More scrapers at thirdwatch.dev.