How to Find Business Email Addresses for Free (7 Methods That Work)

Buying an email list sounds like a shortcut. But most purchased lists are outdated, full of bounces, and shared with every other business that bought the same list. You end up sending to contacts who haven't worked at those companies in three years.

Building your own list takes more time upfront. But the contacts are current, they're specific to your target market, and nobody else is emailing them from the same list you bought.

Here are 7 methods that work for service businesses — no paid tools required.

Method 1: Google Search Operators

This is the fastest way to find email addresses on a target company's website.

Use this search format in Google:

site:companywebsite.com "email" OR "@companywebsite.com"

Example: site:acmeproperty.com "email" OR "@acmeproperty.com"

This tells Google to look only on that company's website for pages that include their email domain. Contact pages, staff directories, and "about us" pages often have email addresses that aren't linked anywhere obvious.

You can also search for patterns:

"@acmeproperty.com" -site:acmeproperty.com

That second search finds external sites (directories, LinkedIn profiles, press releases) that mention the company's email domain. Sometimes it surfaces email addresses the company didn't intend to publish.

Method 2: Guess the Pattern With Hunter.io

Most companies use one email format: firstname@domain.com, or first.last@domain.com, or just john@domain.com.

Hunter.io (free tier: 25 searches/month) shows you the email format a company uses based on emails it's already indexed. Type in a company's domain and it tells you something like "firstname@domain.com (used 94% of the time at this company)."

Once you know the pattern, you can construct email addresses for anyone at that company using their name from LinkedIn or the company website.

The verification step (below) confirms whether the address you guessed is real before you send.

Method 3: LinkedIn With a Browser Extension

LinkedIn shows you names and titles. It doesn't show email addresses. But combining LinkedIn search with a free browser extension bridges that gap.

The process:

1. Search LinkedIn for your target title + city. For contractors targeting property managers: "property manager" + "Dallas" with a People filter.
2. Scroll through results and note the names and companies of people who match.
3. Use a browser extension like Snov.io (100 free credits/month) or Apollo (50 free exports) to surface email addresses for the profiles you're viewing.

This method is slower than domain-based tools but gives you the most targeted contacts — you know exactly the title, city, and company before you add them to your list.

Method 4: Website Contact Forms and About Pages

This sounds obvious, but most service businesses skip it.

For local businesses — property managers, commercial building owners, restaurant operators — their website often has email addresses right on the contact or about page. If it's not on the contact page, try /about, /team, or /staff.

For companies that hide behind generic contact forms, try these less-obvious paths:

• /privacy-policy (often lists a privacy contact email)
• /terms (same)
• The business's Google Business Profile (sometimes shows an email)
• The footer (company-level emails often live here: info@, admin@, office@)

These emails usually go to a receptionist or general inbox — not ideal for cold outreach. But they're a starting point if you can't find a specific contact.

Method 5: Google Maps for Local Businesses

If you're targeting local service businesses — property management companies, restaurants, commercial buildings — Google Maps is underrated.

Search for your target type in your city. Click through to each business's Maps listing. Many of them have websites linked directly. From the website, use Method 4 above.

Google Maps also shows phone numbers. Sometimes calling and asking "who handles your [service] vendors — can I get their email?" takes 60 seconds and gives you the exact person.

Don't overlook this. Local contractors who do this consistently build better lists than contractors who rely entirely on automation.

Method 6: LinkedIn Company Pages

Company pages on LinkedIn often list employees. The free version lets you see the first few employees on a company page — usually enough to identify the right contact.

Steps:

1. Search LinkedIn for the company.
2. Click their company page → "See all employees."
3. Filter by title relevant to your offer (e.g., "facilities manager," "property manager," "operations director").
4. Note the name and use Hunter.io or a domain pattern to construct their email.

The free tier of LinkedIn limits how many profiles you can view per day. Work through 20–30 companies per session rather than 200 in a day, and you won't hit the limit.

Method 7: Industry Directories

Every major trade has directories that list business contacts:

• Property management: IREM (Institute of Real Estate Management) member directories, local apartment association websites
• Commercial real estate: CoStar (free search tier), LoopNet
• Restaurant industry: State restaurant association directories, local chamber of commerce
• HOA management: Community Associations Institute chapter directories

These directories often include email addresses or phone numbers for members. They're lower volume but higher quality — the contacts are verified members of professional organizations, which means they're more likely to be active in their role.

Verifying Before You Send

Finding an email is only half the job. Sending to bad addresses destroys your domain reputation.

Before adding any address to a sending sequence, verify it with one of these free tools:

• ZeroBounce — 100 free verifications/month
• NeverBounce — 1,000 free verifications on signup
• Hunter.io — shows a confidence score alongside each email it finds

A bounced email tells the receiving mail server that you're sending to non-existent addresses. Enough bounces and your domain gets flagged as a spam source. Five percent bounce rate is the maximum safe threshold — above that, deliverability starts dropping.

Building the Right Size List

For most contractors starting with cold outreach, 100–200 verified contacts is the right list size for your first month.

That's small enough to personalize well and stay under sending limits during your warmup period. It's also big enough to get statistically meaningful data on what's working — subject lines, email copy, which types of contacts reply.

After month one, you'll know your reply rate, which segments are worth pursuing, and what copy is landing. Then you can scale up.

Where LeadClaw Fits

Manual list-building takes 2–3 hours per 100 contacts. At that pace, building a continuous pipeline of new prospects is a part-time job on top of running your business.

LeadClaw automates the research and verification step — it finds, verifies, and sequences outreach to new contacts continuously, so your pipeline keeps growing while you're on job sites.

But even if you're building your list manually, these 7 methods give you everything you need to start for free. Get your first 100 contacts, send your first campaign, and see what comes back. The learning is worth more than any purchased list.

Start with LeadClaw if you want the research done for you.