LinkedIn Email Finder — Profile URL to Email (No Login)

What you get

Generate likely work email addresses from LinkedIn profile URLs or name-and-domain pairs. No login, cookies, or Sales Navigator seat. Every result includes ranked candidates and an explicit confidence/verification status so an inferred address is never presented as guaranteed.

Works inside Claude, ChatGPT, and any MCP-compatible agent via the Apify connector. Pairs cleanly with LinkedIn Employees Scraper — run that first to build a target list, then this to fill in emails.

Two input modes

Mode 1 (recommended): Direct contacts

Best for high-volume prospecting. Provide name + domain (or name + company); the actor skips LinkedIn entirely. This is the right path when chaining from LinkedIn Employees Scraper — that actor outputs name + company already.

{
  "contacts": [
    {"firstName": "Jane", "lastName": "Doe", "domain": "stripe.com"},
    {"fullName": "John Smith", "company": "Acme Inc", "companyUrl": "https://acme.com"}
  ]
}

Mode 2: Profile URLs (best-effort)

Supply LinkedIn profile URLs. The actor attempts to fetch each profile for name + company; falls back to URL-slug parsing if LinkedIn's authwall blocks the fetch. Use domainOverride to guarantee a usable domain when LinkedIn fetch fails.

{
  "profiles": [
    "https://www.linkedin.com/in/jane-doe-12a/",
    "https://www.linkedin.com/in/jsmith-acme/"
  ],
  "domainOverride": "stripe.com"
}

How it works

1. Extract name + company — from the candidate's public LinkedIn profile page (no login needed)
2. Resolve domain — from LinkedIn company website, then heuristic fallback
3. Generate candidates — 11 common B2B patterns weighted by real-world frequency: first.last, first, flast, first_last, etc.
4. Verify — MX lookup + optional SMTP RCPT TO probe with catch-all detection
5. Rank — verified > catch_all > pattern + MX > pattern only

Output

Field	Description
fullName	Person's name
firstName / lastName	Parsed name parts
company	Current employer (from LinkedIn)
domain	Derived company domain
primaryEmail	Best-guess email
candidates	All weighted candidates [{email, weight}]
verificationStatus	verified / catch_all / mx_only / no_mx / smtp_blocked / skipped
confidence	verified / catch_all / pattern / pattern_no_mx / low
verifiedEmails	Emails the SMTP server accepted
mxHosts	Mail servers found via DNS
catchAll	Whether the domain accepts all addresses
profileUrl	Original LinkedIn URL

Verification reality check

SMTP verification works when:

• The target domain's MX accepts inbound connections from our IP
• It returns clear 550-style rejects for unknown addresses (not all do)

When SMTP probing is blocked (port 25 outbound restrictions, greylisting, catch-all configs) the actor falls back to MX-validated pattern guessing. Pattern-based confidence is ~60-70% on real B2B domains — high enough for warm outbound, low enough you should still bounce-test before mass sending.

Compared to alternatives

Tool	Cost	Login required	Verification
This actor	From $0.002/email candidate; empty lookups free	No	MX + optional SMTP
Hunter.io	$0.049/search	API key	Yes
Apollo	$99/mo seat	Account	Yes
Snov	$0.027/credit	API key	Yes

Tips

1. Pair with LinkedIn Employees Scraper — run it first for prospect lists, then feed profile URLs here.
2. Use domainOverride when LinkedIn shows a parent brand but you want subsidiary emails.
3. Enable verifyEmails only when you want SMTP evidence. It is off by default because many mail servers block probes.
4. Always bounce-test before mass sending — pattern matches without SMTP verification still bounce 30–40% of the time.

Input parameters

Parameter	Required	Description
profiles	No	List of LinkedIn profile URLs (e.g. https://www.linkedin.com/in/username/). The actor fetches each profile to extract name and current company, then derives the most likely work email. Use this OR the 'contacts' field below.
contacts	No	Pre-extracted contacts as objects with firstName, lastName, and either company or domain. Skips the LinkedIn fetch entirely (cheaper). Example: [{"firstName":"Jane","lastName":"Doe","domain":"stripe.com"}].
domainOverride	No	Force all lookups to use this domain (e.g. 'stripe.com'). Useful when LinkedIn shows a parent brand but you want subsidiary emails.
verifyEmails	No	Attempt SMTP RCPT TO verification for top candidates. Availability depends on the recipient mail server and network policy; MX validation always remains available.
maxResults	No	Cap total profiles processed across all inputs.
proxyConfiguration	No	Apify proxy configuration. Residential recommended for LinkedIn fetches to maximise success.

Use cases

• Sales teams building outreach lists
• Agencies sourcing local-business leads
• RevOps teams enriching CRM records

Limitations

• Results reflect the public source at run time; removed or restricted items disappear between runs.
• Fields that are not publicly disclosed stay empty rather than being guessed.
• Use public data lawfully and respect applicable privacy and platform rules.

Last verified: 2026-07

More scrapers at thirdwatch.dev.