LinkedIn Email Finder — Profile URL to Email (No Login)

Generate likely work email addresses from LinkedIn profile URLs or name-and-domain pairs. No login, cookies, or Sales Navigator seat. Every result includes ranked candidates and an explicit confidence/verification status so an inferred address is never presented as guaranteed.

Works inside Claude, ChatGPT, and any MCP-compatible agent via the Apify connector. Pairs cleanly with LinkedIn Employees Scraper — run that first to build a target list, then this to fill in emails.

Two input modes

Mode 1 (recommended): Direct contacts

Best for high-volume prospecting. Provide name + domain (or name + company); the actor skips LinkedIn entirely. This is the right path when chaining from LinkedIn Employees Scraper — that actor outputs name + company already.

{
  "contacts": [
    {"firstName": "Jane", "lastName": "Doe", "domain": "stripe.com"},
    {"fullName": "John Smith", "company": "Acme Inc", "companyUrl": "https://acme.com"}
  ]
}

Mode 2: Profile URLs (best-effort)

Supply LinkedIn profile URLs. The actor attempts to fetch each profile for name + company; falls back to URL-slug parsing if LinkedIn's authwall blocks the fetch. Use domainOverride to guarantee a usable domain when LinkedIn fetch fails.

{
  "profiles": [
    "https://www.linkedin.com/in/jane-doe-12a/",
    "https://www.linkedin.com/in/jsmith-acme/"
  ],
  "domainOverride": "stripe.com"
}

How it works

1. Extract name + company — JSON-LD from LinkedIn's public profile page (no login needed)
2. Resolve domain — from LinkedIn company website, then heuristic fallback
3. Generate candidates — 11 common B2B patterns weighted by real-world frequency: first.last, first, flast, first_last, etc.
4. Verify — MX lookup + optional SMTP RCPT TO probe with catch-all detection
5. Rank — verified > catch_all > pattern + MX > pattern only

Output

Field	Description
fullName	Person's name
firstName / lastName	Parsed name parts
company	Current employer (from LinkedIn)
domain	Derived company domain
primaryEmail	Best-guess email
candidates	All weighted candidates [{email, weight}]
verificationStatus	verified / catch_all / mx_only / no_mx / smtp_blocked / skipped
confidence	verified / catch_all / pattern / pattern_no_mx / low
verifiedEmails	Emails the SMTP server accepted
mxHosts	Mail servers found via DNS
catchAll	Whether the domain accepts all addresses
profileUrl	Original LinkedIn URL

Verification reality check

SMTP verification works when:

• The target domain's MX accepts inbound connections from our IP
• It returns clear 550-style rejects for unknown addresses (not all do)

When SMTP probing is blocked (port 25 outbound restrictions, greylisting, catch-all configs) the actor falls back to MX-validated pattern guessing. Pattern-based confidence is ~60-70% on real B2B domains — high enough for warm outbound, low enough you should still bounce-test before mass sending.

Pricing

You are charged only when the Actor returns a primaryEmail; empty lookups are free. Tiered FREE/BRONZE/SILVER/GOLD pricing is $0.005 / $0.004 / $0.003 / $0.002 per email candidate. Candidate generation, MX lookup, and optional SMTP evidence are included.

Compared to alternatives

Tool	Cost	Login required	Verification
This actor	From $0.002/email candidate; empty lookups free	No	MX + optional SMTP
Hunter.io	$0.049/search	API key	Yes
Apollo	$99/mo seat	Account	Yes
Snov	$0.027/credit	API key	Yes

Tips

1. Pair with LinkedIn Employees Scraper — run it first for prospect lists, then feed profile URLs here.
2. Use domainOverride when LinkedIn shows a parent brand but you want subsidiary emails.
3. Enable verifyEmails only when you want SMTP evidence. It is off by default because many mail servers block probes.
4. Always bounce-test before mass sending — pattern matches without SMTP verification still bounce 30–40% of the time.

Last verified: 2026-07

More scrapers at thirdwatch.dev.