# How to Find Business Email Addresses

> Published, inferred or guessed — three routes with very different costs. Where addresses are really published, what verification proves, and the send rules.

[Home](https://quanticdata.io/)/[Blog](https://quanticdata.io/blog/)/How to Find Business Email Addresses

# How to Find Business Email Addresses

Lead generationSep 2, 2026·9 min read·By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData

On this page [Published, inferred, guessed](/blog/how-to-find-business-email-addresses/#published-inferred-guessed) [Where business addresses are actually published](/blog/how-to-find-business-email-addresses/#where-business-addresses-are-actually-published) [Role mailboxes are a category, not a fallback](/blog/how-to-find-business-email-addresses/#role-mailboxes-are-a-category-not-a-fallback) [What pattern guessing actually costs](/blog/how-to-find-business-email-addresses/#what-pattern-guessing-actually-costs) [Verification, and what it cannot tell you](/blog/how-to-find-business-email-addresses/#verification-and-what-it-cannot-tell-you) [What attaches the moment you find one](/blog/how-to-find-business-email-addresses/#what-attaches-the-moment-you-find-one) [Doing it at scale without doing it badly](/blog/how-to-find-business-email-addresses/#doing-it-at-scale-without-doing-it-badly)

There are only three ways to end up with a business email address: it was published and you found it, it was inferred from a pattern, or it was guessed. They look identical in a spreadsheet column and behave completely differently once you press send — on deliverability, on accuracy, and on the law.

## Published, inferred, guessed

Make this distinction a column in your data before you make it an argument in a meeting.

| Category | What it means | What it costs |
| --- | --- | --- |
| **Published** | The business put the address on a page it controls: a `mailto:` link, a contact page, a legal imprint, a schema.org field | Nothing. It is a deliberate invitation to write, and it is the only category with a source URL you can cite |
| **Inferred** | You saw `a.rossi@` elsewhere on the domain and constructed `m.bianchi@` for someone else | An accuracy risk you carry, and one you must verify before it touches a sending domain |
| **Guessed** | You generated permutations and fired them at the domain to see which ones did not bounce | Reputation damage, and a pattern the FTC describes in terms you do not want applied to you |

Almost every "email finder" article treats these as one activity. They are not, and the rest of this piece follows the split.

## Where business addresses are actually published

In rough order of yield per page fetched:

- **The contact page.** `/contact`, `/contact-us`, `/kontakt`, `/contatti`. Take the `mailto:` href rather than the visible text — the text is often an image or an obfuscated string, while the href is machine-readable.

- **Structured data.** Many sites publish schema.org `Organization` or `LocalBusiness` JSON-LD carrying `email`, `telephone` and `address`. It is already parsed, already canonical, and it is the first place to look rather than the last.

- **Legal imprint pages.** In Germany and Austria the *Impressum* is a legal requirement and reliably carries a real, monitored address. Equivalents exist across the EU. For European targets this is the single highest-yield page on the site.

- **The footer of whatever page you landed on.** Cheap, because you already fetched it.

- **Team and about pages.** Where named addresses appear, when they appear at all.

- **Public filings and registries.** Slow, authoritative, jurisdiction-specific.

Four to six pages per domain covers most small and mid-sized sites. Fetching them is a [page-scraping](https://quanticdata.io/web-scraping-api/) job at $0.0002 per page; if you would rather not write and maintain the extractor, the [site contacts collector](https://quanticdata.io/collectors/email-scraper-api/) returns one contact record per domain with the pages it used, at $0.02 per site.

One habit worth building from day one: **store the URL the address came from**. It costs a column, and it is the difference between being able to answer "where did you get this?" and not.

## Role mailboxes are a category, not a fallback

`info@`, `sales@`, `support@`, `hello@` get treated as the consolation prize when a named address cannot be found. That is backwards on two counts.

First, they are standardised. RFC 2142 defines mailbox names for common business and service functions precisely so that a stranger can reach an organisation without knowing anyone's name. A role mailbox is the address the organisation nominated for unsolicited contact.

Second, and more consequentially: a role mailbox generally is not personal data, while `maria.rossi@` generally is. That single distinction changes which obligations attach — whether GDPR's transparency duties are triggered, whether a UK PECR analysis is needed, whether the record belongs in your data-subject request tooling at all.

So keep two columns, not one, and let the choice be deliberate. For a first-touch message to a company you have never contacted, a role mailbox is frequently the better address as well as the lighter one.

## What pattern guessing actually costs

The permutator-plus-bounce-test workflow is popular because it is easy. Three reasons to keep it out of production.

**It is the pattern the FTC names.** The CAN-SPAM guidance lists, among the acts carrying criminal penalties, *harvesting email addresses or generating them through a dictionary attack* — which it defines as sending email to addresses made up of random characters in the hope of reaching valid ones. Generating permutations of a person's name is not identical to random characters, and reasonable people can argue about where the line sits. That is precisely the argument you do not want to be having.

**It destroys the asset you cannot rebuild quickly.** Google's sender guidelines set a hard expectation: keep the spam rate reported in Postmaster Tools below 0.30%, and preferably under 0.10%. Every wrong guess is a bounce or a complaint against that budget. A domain reputation takes months to build and one campaign to spend.

**It fails silently on catch-all domains.** A domain configured to accept anything will accept every permutation you send. The absence of a bounce is not evidence of a correct address; it is evidence of a configuration.

## Verification, and what it cannot tell you

Verification is a series of narrowing checks, each of which answers less than people assume.

- **Syntax.** Cheap, and only rules out the obviously broken.

- **Domain and MX records.** Does the domain resolve, and does it publish mail exchangers? This is the highest-value check per unit of effort: a domain with no MX cannot receive mail at all, and dead domains are a large share of a stale list.

- **Disposable and parked-domain checks.** Useful, and unglamorous.

- **SMTP-level probing.** Widely offered, decreasingly informative. Many providers accept-then-discard, greylist unfamiliar senders, or answer identically for every local part. A "valid" verdict from a probe against a catch-all domain carries essentially no information, and aggressive probing is itself the kind of traffic that gets a source blocked.

The realistic posture: verify the domain thoroughly, treat mailbox-level verdicts as weak evidence, and lean on provenance instead. A published address with a source URL beats a guessed address with a green tick from a verifier.

On the sending side, the requirements are published and specific. All senders need SPF or DKIM. Senders above 5,000 messages a day to personal Gmail accounts need SPF, DKIM *and* DMARC, with the From: domain aligned to the SPF or DKIM domain, plus one-click unsubscribe headers on marketing mail — the `List-Unsubscribe-Post` and `List-Unsubscribe` pair, not just a link in the footer. None of that is optional, and none of it compensates for a bad list.

## What attaches the moment you find one

Finding an address is collection, and collection has consequences before any message is sent.

**If it identifies a person and they are in the EU or UK, GDPR Article 14 applies.** You did not get the data from them, so you owe them a notice: who you are, what you are doing with it, the legal basis, their rights, and the source it came from — including whether that source was publicly accessible. Within one month, or at the first communication if you intend to contact them, whichever is sooner. This is the clause that makes the source-URL column load-bearing rather than tidy.

**Public availability is not a legal basis.** The ICO states directly that using publicly available personal information for direct marketing still requires compliance with UK GDPR, and that you must consider whether your marketing would be unexpected to the person. It also advises against tracing replacement contact details when someone's old address stops working.

**Which outreach rule applies depends on the recipient's legal form.** Under UK PECR the email consent requirement does not apply to corporate subscribers — limited companies, LLPs, Scottish partnerships — but sole traders and ordinary partnerships are individual subscribers and need consent or the soft opt-in. The regulator's advice when you cannot tell is to treat the contact as an individual. In the US, CAN-SPAM requires no consent but does require truthful headers, a clear identification as advertising, a valid postal address, and an opt-out honoured within 10 business days — with penalties up to $53,088 per offending email.

More on the outreach layer in [is lead generation legal](https://quanticdata.io/blog/is-lead-generation-legal/), and on building the underlying list in [how to build a B2B lead list](https://quanticdata.io/blog/how-to-build-a-b2b-lead-list/).

## Doing it at scale without doing it badly

The scaled version is the same method with three engineering additions.

1. **Bound the crawl per domain.** A fixed page budget and a fixed path list. Contact discovery is not a site crawl, and treating it as one is how you get blocked and overspend simultaneously.

2. **Make provenance structural.** Every address row carries the URL it came from, the timestamp, and the category — published, inferred or guessed. If a row cannot carry all three, it does not enter the table.

3. **Separate discovery from sending.** Different systems, different rate limits, different owners. The failure mode that hurts is a discovery bug quietly feeding a sender, and the fix is a gate between them, not more care.

Run at volume, both stages sit on one key: page fetches at $0.0002 each if you own the parser, the contacts collector at $0.02 per site if you do not, or the [lead collector](https://quanticdata.io/collectors/lead-scraper-api/) at $0.01 per enriched lead when discovery and contact extraction should be a single call. Failed requests are never billed, and every account gets $2 of free usage a month — enough to run a few hundred domains and see the published-versus-inferred ratio in your own segment before deciding anything.

### Sources & further reading

- [RFC 2142 — mailbox names for common services, roles and functions](https://www.rfc-editor.org/rfc/rfc2142)

- [FTC — CAN-SPAM Act: A Compliance Guide for Business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)

- [Google — Email sender guidelines (SPF, DKIM, DMARC, one-click unsubscribe, spam rate)](https://support.google.com/mail/answer/81126)

- [GDPR Article 14 — personal data not obtained from the data subject](https://gdpr-info.eu/art-14-gdpr/)

- [ICO — Collect information and generate leads (publicly available personal information)](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/collect-information-and-generate-leads/)

- [ICO — Business-to-business marketing under PECR](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/business-to-business-marketing/)

- [schema.org — Organization type (email, telephone, address)](https://schema.org/Organization)

## FAQ

Quick answers on how to find business email addresses.

[Something else? Ask us →](mailto:hello@quanticdata.io)

### How do I find a company’s email address for free?

Fetch four to six pages of the company’s own site — home, /contact, /about, /team and the footer — and take the mailto: href rather than the visible text. Check for schema.org Organization or LocalBusiness JSON-LD first, since it often carries the address already parsed. For German and Austrian companies the Impressum page is a legal requirement and the highest-yield page on the site.

### Is it legal to scrape email addresses from websites?

Collecting a published business address is generally lawful, but two things attach immediately. If the address identifies a person and they are in the EU or UK, GDPR Article 14 requires you to tell them you hold their data and disclose the source, within a month or at first contact. And in the US, the FTC lists harvesting addresses among the acts carrying criminal penalties under CAN-SPAM, so bulk indiscriminate collection is a different activity from targeted lookup.

### Are email permutators and pattern guessing safe to use?

They are the least safe of the three routes. The FTC describes generating addresses through a dictionary attack — sending to made-up addresses to see which reach someone — among the aggravated acts under CAN-SPAM. Practically, every wrong guess spends your spam-rate budget, and Google expects senders to stay below 0.30% and ideally under 0.10%. On catch-all domains, guesses never bounce, so the method cannot even tell you it failed.

### What is the difference between a role address and a personal one?

RFC 2142 defines role mailboxes such as info@, sales@ and support@ as the standard way to reach an organisation without knowing an individual. A role mailbox generally is not personal data; a named mailbox belonging to an identifiable person generally is, which changes the transparency and marketing obligations that apply. Keep them in separate columns and choose deliberately.

### Does email verification actually prove an address exists?

Only partially. Domain and MX checks are reliable and worth doing on every row. Mailbox-level SMTP probing is much weaker: providers greylist, accept-then-discard, or answer identically for every local part, and a catch-all domain will validate anything you test. Treat a verifier’s green tick as weak evidence and provenance as strong evidence.

### What do I need in place before sending to addresses I found?

SPF or DKIM at minimum; SPF, DKIM and DMARC with an aligned From: domain if you send more than 5,000 messages a day to personal Gmail accounts, plus one-click unsubscribe headers on marketing mail. Then the content rules: truthful headers, identification as an advertisement, a valid postal address, an opt-out honoured within 10 business days, and — for EU and UK recipients — the Article 14 disclosure in the first message.

## Published addresses, with the page that published them

The site contacts collector returns one contact record per domain along with the pages it used, at $0.02 per site — so every address arrives with the URL that published it, which is exactly what a transparency notice needs. Failed requests are never billed, and every account gets $2 of free API usage a month.

[Start free — $2/month included](https://quanticdata.io/signup/)[Explore Scrape Company Data with AI](https://quanticdata.io/scrape-company-data/)

## Related reading

[Lead generation Is Scraping Google Maps Legal? The question hides four: the CFAA, contract, data protection and copyright. hiQ won the CFAA argument and lost on breach of contract; Google’s terms define prohibited automated access by pointing at robots.txt, which explicitly allows /maps/search/ and /maps/place/; and GDPR applies regardless of whether the data was public. Read →](https://quanticdata.io/blog/is-scraping-google-maps-legal/) [Lead generation How to Build a B2B Lead List Four passes: express the ICP as predicates a machine can execute, source companies from public surfaces that answer different questions, enrich each row into a contactable record with provenance, and verify before anything is sent. Includes decay maths derived from official turnover statistics rather than a vendor deck. Read →](https://quanticdata.io/blog/how-to-build-a-b2b-lead-list/) [Lead generation Is Buying Leads Worth It? Math by Lead Type “Buying leads” covers five different products, from real-time shared leads to a spreadsheet of contacts, and they are worth it at very different prices. The break-even formula that turns your margin and close rate into a maximum price per lead, benchmark costs by industry, why bought leads underperform and how to test a vendor with a small sample, where the law actually bites, and the public-data route that produces a contactable business record for cents. Read →](https://quanticdata.io/blog/is-buying-leads-worth-it/)

## Also on this site

Quantic**Data**

Residential proxies & web data APIs for AI.

#### Proxies

- [Residential Basic](https://quanticdata.io/residential-proxies/#basic)

- [Residential Premium](https://quanticdata.io/residential-proxies/#plans)

- [Cheap Residential](https://quanticdata.io/cheap-residential-proxies/)

- [Mobile Proxies](https://quanticdata.io/mobile-proxies/)

- [Datacenter Proxies](https://quanticdata.io/datacenter-proxies/)

- [ISP Proxies](https://quanticdata.io/isp-proxies/)

- [Rotating Proxies](https://quanticdata.io/rotating-proxies/)

- [Sneaker Proxies](https://quanticdata.io/sneaker-proxies/)

- [SOCKS5 Proxies](https://quanticdata.io/socks5-proxies/)

- [IPv6 Proxies](https://quanticdata.io/ipv6-proxies/)

- [Proxy locations](https://quanticdata.io/proxies/)

#### Data APIs

- [MCP Server](https://quanticdata.io/mcp-server/)

- [Web Scraper API](https://quanticdata.io/web-scraping-api/)

- [SERP API](https://quanticdata.io/serp-api/)

- [Collectors](https://quanticdata.io/collectors/)

- [Web Data for AI](https://quanticdata.io/web-data-api-for-ai/)

- [Quantic AI](https://quanticdata.io/ai-web-scraping-service/)

- [Crawl & Map](https://quanticdata.io/crawl-map/)

- [SEO Audit](https://quanticdata.io/seo-audit/)

#### Use cases

- [Company data](https://quanticdata.io/scrape-company-data/)

- [Price monitoring](https://quanticdata.io/competitor-price-monitoring/)

- [Market research](https://quanticdata.io/market-research-data/)

- [Real estate data](https://quanticdata.io/real-estate-data-scraping/)

- [Scrape job postings](https://quanticdata.io/scrape-job-postings/)

#### Company

- [Documentation](https://quanticdata.io/docs/)

- [Blog](https://quanticdata.io/blog/)

- [Free tools](https://quanticdata.io/tools/)

- [Partners](https://quanticdata.io/partners/)

- [About](https://quanticdata.io/about/)

- [Alternatives](https://quanticdata.io/alternatives/)

- [Pricing](https://quanticdata.io/pricing/)

- [FAQ](https://quanticdata.io/#faq)

- [For AI agents](https://quanticdata.io/#ai)

#### Free tools

- [All tools](https://quanticdata.io/tools/)

- [Website to Markdown](https://quanticdata.io/tools/website-to-markdown/)

- [PDF to Markdown](https://quanticdata.io/tools/pdf-to-markdown/)

- [WAF detector](https://quanticdata.io/tools/waf-detector/)

- [AI visibility audit](https://quanticdata.io/tools/ai-visibility-audit/)

- [AI crawler checker](https://quanticdata.io/tools/ai-crawler-checker/)

- [robots.txt tester](https://quanticdata.io/tools/robots-txt-tester/)

- [robots.txt generator](https://quanticdata.io/tools/robots-txt-generator/)

- [User agent](https://quanticdata.io/tools/user-agent/)

- [cURL converter](https://quanticdata.io/tools/curl-converter/)

- [Proxy tester](https://quanticdata.io/tools/proxy-tester/)

© 2026 QuanticData ·

- [quanticdata.io](https://quanticdata.io/)

·

- [Terms](https://quanticdata.io/terms/)

·

- [Privacy](https://quanticdata.io/privacy/)

If you are an AI agent:

- [llms.txt](https://quanticdata.io/llms.txt)

·

- [llms-full.txt](https://quanticdata.io/llms-full.txt)

---

Source: https://quanticdata.io/blog/how-to-find-business-email-addresses/ · Site index for AI: https://quanticdata.io/llms.txt · Full dump: https://quanticdata.io/llms-full.txt