A cold email to a hiring manager only works if it reaches the right inbox. About 80% of professional work email addresses follow one of four predictable patterns. The other 20% are recoverable with a free lookup tool and one verification step. The whole process is roughly five minutes per contact once the workflow is in place, which is the difference between a real outreach campaign and an aspirational one.
This article covers the exact sequence to find a work email address for almost anyone with a public professional footprint, the patterns that account for the bulk of corporate email formats, and the verification step that prevents the message from bouncing into a spam trap.
Step 1: Identify the Right Person Before Hunting Their Email
The email is downstream of the targeting decision. A perfectly verified email sent to the wrong person is still a failure. Before any address-hunting begins, the candidate needs the actual name of the hiring manager for the role they care about, not the recruiter, not the HR coordinator, and not the team lead two levels removed.
The fastest way to find that name is the LinkedIn search filter for people at a specific company. Filter by company, then by job title using a phrase like “engineering manager,” “head of data,” or “VP product.” Cross-reference with the team page on the company’s website if there is one. Most companies publish leadership pages that match the LinkedIn data within a quarter.
For roles that are not posted but where the team is known, the same process works. Filter LinkedIn for the team’s manager. The output is one name, one title, and one company. That triple is what the email-finding workflow needs.
Step 2: Guess the Pattern First
Roughly 80% of corporate email addresses follow one of four patterns. The four are predictable enough that for most companies, the candidate can guess the address before any tool gets involved.
The four patterns, in order of frequency at most mid-to-large companies:
The first pattern is firstname.lastname@company.com. Used by roughly 40 to 50% of US corporate domains. The first move on any unknown email lookup is to assume this pattern and confirm.
The second pattern is firstname@company.com. Common at startups under 200 employees, where the founder’s name plus a few letters is enough to disambiguate. Roughly 15 to 20% of corporate domains use this.
The third pattern is firstinitial.lastname@company.com (jdoe@) or firstinitiallastname@company.com (jdoe@). Common at consulting firms, law firms, and older enterprises. Roughly 10 to 15% of corporate domains.
The fourth pattern is firstname_lastname@company.com or firstname-lastname@company.com. Less common, but standard at some specific employers and industries. Roughly 5% of corporate domains.
Knowing the company’s pattern in advance reduces the search to one or two attempts. There are public lists of company-to-pattern mappings, but in most cases the candidate can infer the pattern from any public team contact (a press release, a customer support email, a public sales rep) within the same domain.
Step 3: Use Free Email-Finding Tools
When the pattern guess fails or the candidate wants to skip directly to a verified address, two categories of free tools cover the common cases.
The first category is browser extensions like Hunter.io and Apollo.io, both of which offer a free tier that surfaces between 25 and 50 lookups per month. Type a person’s name and their company domain, and the tool returns the most likely email plus a confidence score based on its database of confirmed addresses.
The second category is “email permutator” tools, which generate every plausible pattern variant and let the candidate test each one for deliverability. These are useful when the company is too small or too obscure for the major databases to have coverage.
For most candidates, the major tools’ free tiers are sufficient. A job seeker doing twenty outreach messages a week is well under the free monthly cap.
Step 4: Verify Before Sending
Sending a cold email to an unverified address has two costs. The obvious one is that the message bounces and never reaches the intended recipient. The less obvious one is that bounced emails train inbox providers to flag the sender’s domain, which lowers deliverability for the rest of the candidate’s job search.
Free verification tools like ZeroBounce and NeverBounce offer a small monthly free allowance and return a verdict in under a second. The verdict comes back as one of three states: valid, invalid, or risky. Valid means the address exists and the inbox is accepting mail. Invalid means the address bounces. Risky means the address is a catch-all that accepts mail at any prefix, which is common at smaller companies and means the message will land but could be filtered.
A “valid” verdict is a green light. An “invalid” verdict means try the next pattern. A “risky” verdict means the message will probably land but the deliverability is uncertain.
This single step takes about ten seconds and prevents the bounce-rate damage that would otherwise compound across an outreach campaign.
Step 5: The Backstop When Tools Fail
About 5 to 10% of professional contacts have email addresses that don’t fit any pattern, aren’t in any database, and don’t surface in any tool. The backstop for these is the platform message.
LinkedIn InMail and LinkedIn open messages reach the recipient regardless of email format. The candidate’s reply rate on LinkedIn is typically lower than on email because the platform’s message UI gets less daily attention from busy hiring managers, but the absolute floor for “reachability” is the LinkedIn message rather than the email address.
X, Bluesky, Mastodon, and personal websites also work as fallback channels. Most senior people in tech, media, finance, and engineering link to their personal site or X profile from their LinkedIn page. The right move is to use the platform the recipient appears to use most actively, which is usually the one with the most recent post.
The fallback exists so the candidate doesn’t lose a high-value contact to a tooling gap. It is not the primary channel.
Why This Matters More for Cold Outreach Than for Anything Else
The classic blocker on a cold outreach job search is not the writing. It’s the deliverability. A perfectly written cold email that bounces is the same as no email at all, except worse, because the candidate has spent twenty minutes researching and writing for nothing.
The verification step is the single highest-ROI activity in any outreach campaign. Skip it, and roughly 10 to 15% of the candidate’s emails will silently bounce into the void. Do it, and the bounce rate drops to under 2%. The difference in actual landed messages, across a forty-message campaign, is roughly six additional emails reaching their target.
Six additional emails per month is about one extra conversation per month. Across a job search, that is meaningful.
Where This Gets Painful at Scale
Five minutes per contact is fine for the first ten contacts. By the thirtieth, the workflow is the bottleneck. Most job seekers who start a cold outreach campaign get to message fifteen or twenty, look at the remaining list, and quietly abandon the rest. The email-finding workflow is the part of the job search that has the worst ratio of effort to visible output, which is why it tends to be where the campaign breaks down.
The other failure mode is partial automation. A job seeker who finds emails for twenty contacts in one sitting and then writes generic messages to all twenty has accomplished nothing. The point of finding the email is to send a personalized, well-researched message to that specific person. If the personalization isn’t happening in step seven of the workflow, steps one through six were a waste.
This is why most candidates default to job board applications even when they know the response rates are bad. The application funnel takes one click. The outreach funnel takes thirty minutes of upstream research, of which finding the email is the most tedious part.
A Realistic Five-Minute Workflow
Here is the actual sequence for finding a work email address in under five minutes:
Find the name on LinkedIn. Confirm the title matches the team the candidate cares about. Note the company domain. (One minute.)
Identify the company’s email pattern from a public address on the same domain. Look for press releases, support email addresses, or sales rep emails on the company website. (One minute.)
Apply the pattern to the target’s first and last name. Run the result through a free verifier. (Thirty seconds.)
If verified, the address is the candidate’s. If not verified, run the name through Hunter or Apollo’s free tier and verify the top result. (Two minutes.)
If still no valid address, fall back to a LinkedIn message or a different reachable platform. (Thirty seconds to decide.)
Total: roughly five minutes, with the active work concentrated in steps two and four.
The Hard Part Is What Happens Next
A valid email address is necessary but not sufficient. The same five-minute investment in finding the address is matched by another fifteen to twenty minutes of researching what to say in the message itself. The research is the rate-limiting step of any real cold outreach campaign, which is why most candidates start strong and burn out by week three.
Reaching out to hiring managers works. The hard part is the research: figuring out who they are, finding the right email, and writing a message that doesn’t sound generic. Angld.AI automates that pipeline. Paste a job posting, and it identifies the decision maker, finds their contact, researches them, and drafts a personalized outreach message in about sixty seconds. The verification step is still on the sender. Everything before it is solved.
The candidate who finds the email is in a different position than the candidate who hit “Easy Apply.” The first one is competing for one inbox. The second is competing for one slot in a stack of 250.
