Updated June 2, 2026

TL;DR:

Finding CEO emails for free is possible using five manual methods: LinkedIn contact mining, domain pattern detection, public records search, company website inspection, and Google search operators. Each method works without any software cost but requires a separate verification step before sending, because an unverified guess that bounces chips away at your domain's sender reputation. Use these techniques to train new reps on data hygiene fundamentals and fill gaps in thin lists. Once your team needs verified contacts at volume, Instantly.ai SuperSearch gives you 450M+ verified B2B contacts with built-in verification, backed by a 4.2M+ account deliverability network, so you stop trading rep hours for risky guesses and keep bounces below 1%.

Finding a CEO's email address costs nothing in software. Knowing whether that address is still valid before you hit send is what separates reps who protect their domain from reps who crater it in week two.

Sales reps spend roughly 70% of their time on non-selling tasks, and a meaningful portion of that goes to hunting down contact information. When the contacts they find are unverified guesses, every bounce compounds the problem by signaling to Gmail, Outlook, and Yahoo that your domain is a risk. This guide covers five manual methods to find CEO email addresses without paid tools, plus a framework for calculating when manual research stops making economic sense.

This guide is written for sales ops leads and early-stage SDR teams building outbound processes before committing to a paid data tool.

Why manual CEO email research still matters

Manual research teaches reps to read data quality signals, spot catch-all domains, and understand email pattern logic before they rely on automated databases. That foundational knowledge is what keeps your email deliverability for sequences stable when you scale.

Manual research is a valid starting point for lean teams

New SDRs who learn to verify contacts manually develop an instinct for bad data that carries into every tool they use later. They learn to question a result rather than just export and send, which reduces the chance of a deliverability crash during a critical campaign month. For a lean team at the earliest stage of building an outbound motion, manual research is also a legitimate starting point, as long as the team applies strict verification before any send.

The core principle behind all five methods is this: finding an email and verifying it are two separate steps. An address you found manually is a hypothesis until you confirm it resolves to a real inbox. A bounce rate above 2% triggers spam filtering across your entire domain, not just the affected campaign. Staying below 1% is the target, and manual verification is how you protect that threshold when working without tools.

Method 1: pinpoint CEO emails from LinkedIn profiles

LinkedIn is the most reliable first stop for executive contact data because many CEOs list their email publicly for recruiting, investor, or press inquiries. This approach works without a premium account in many cases.

Identify the CEO's LinkedIn profile

Search LinkedIn for the CEO's full name plus company name. Confirm the current role, company size, and tenure match your target. Cross-reference the name against the company's official website to avoid outdated or inactive profiles.

Get the CEO email from contact info

1. Open the CEO's LinkedIn profile.
2. Click "Contact info" directly below their headline and profile photo.
3. If they've listed a business email, it appears here.
4. If the field is empty, note the company domain from their profile for use in Method 2.

Locate address clues in public posts and shared content

Use the LinkedIn search bar to filter the CEO's posts for phrases like "email me at" or "reach me directly." Some executives post contact details when announcing a new role, a book, or a hiring round. PDFs, slide decks, and whitepapers they share frequently include an author contact field in the footer, title slide, or author bio section.

Method 2: predict email addresses from company domains

Pattern-based email finding works because most companies standardize their format across all employees, but a predicted address is still a guess until you confirm it resolves to a real inbox. Services that send without verifying risk serious bounce accumulation, which is why verifying every predicted address before sending is non-negotiable.

Pinpoint the domain and locate a sample staff email

Visit the company's official website. Check the "Contact Us" page or any press release footer for a staff email. Note whether the company uses their primary domain or a subdomain for mail. Then find any verified email from another employee at the same company through their LinkedIn contact info or a quick web search. One confirmed email establishes the format for the entire organization.

Identify likely email address formats

The most common B2B executive email formats are:

• firstname.lastname@company.com (most common)
• f.lastname@company.com
• firstname@company.com
• flastname@company.com
• firstname_lastname@company.com

Apply the confirmed pattern to the CEO's name and build two to three variants to test.

Prevent bounces by validating emails

Never send to a pattern-guessed address without verifying it first. Sending to unverified guesses causes hard bounces that damage your sender reputation and reduce primary inbox placement for every subsequent campaign from that domain. See the verification section below for the free Gmail and Outlook method.

Method 3: uncover executive contact data from public records

Regulatory filings, conference programs, and public business databases contain executive contact information that most reps never check. This method is slower but produces higher-confidence data for publicly traded or venture-backed companies.

Find CEO emails in SEC filings and speaker lists

Search the SEC's EDGAR database at sec.gov for the company name. Executive officers appear in 10-K annual reports, proxy statements, and 8-K current reports. These documents sometimes list direct contact emails or at minimum confirm the executive's full name and role for cross-referencing with domain pattern detection. Conference websites and event agendas also list speaker contact information. CEOs who speak at industry events often have a public bio with a contact email for event coordinators.

Locate executives in trademark data and public profiles

The USPTO public database lists applicant and representative contact information on patent and trademark filings. For founders and early-stage CEOs who filed their own IP, the application often includes a direct email address. Crunchbase company pages list founding team members and sometimes link to personal profiles. AngelList and GitHub profiles for technical founders frequently include contact information. Cross-reference any email found here against the company's known email format before using it in outreach.

Method 4: check company websites for direct emails

Company websites contain more executive contact data than most reps realize. The key is knowing where to look beyond the generic contact form.

Locate CEO details on About Us pages and IR reports

Go to the company's "About," "Team," or "Leadership" page. Many companies list executive names, titles, and email addresses in their leadership directory, especially at smaller firms where the CEO is actively involved in sales and partnerships. Public companies also publish investor relations documents that regularly include executive contact details. Annual reports and IR contact pages often list a direct email for the CEO or investor relations lead. Even if the IR email is a department alias, the domain confirms the format for pattern detection.

Find CEO contacts in press releases and HTML source

Press releases follow a consistent structure, with a boilerplate contact section at the bottom listing a media contact name, phone number, and email. That contact confirms the company's email format. To go further, right-click on any page where you suspect a contact email is embedded and select "View Page Source" or press Ctrl+U. Press Ctrl+F and search for "mailto:" to find any email links in the HTML that the company has not surfaced visibly on the page.

Method 5: find CEO emails with Google operators

Advanced Google search operators let you query the public web for email addresses with precision. These queries work on any browser and cost nothing.

Find emails with the site: operator

Use this query to search a specific domain for any indexed email address:

"CEO Name" site:company.com "@company.com"

This returns any page on the company's domain that includes both the CEO's name and an email address at that domain. It works when the email appears in a press release, a conference bio, or a team directory that search engines have indexed.

Find emails with the filetype: operator and web archives

site:company.com filetype:pdf "CEO Name" email

PDF documents including conference proceedings, whitepapers, and regulatory filings frequently list author contact information. Because PDFs are updated less often than web pages, these results often contain older but still-valid email addresses for established executives.

If a company has removed a contact page, the Wayback Machine at web.archive.org often retains a cached version. Search for the company's "contact" or "team" URL on archive.org and check recent snapshots. You can also broaden the search with:

filetype:pdf "Company Name" "@company.com" "CEO"

This covers SEC filings, industry reports, and event proceedings published across the public web, which is useful for companies that don't publish individual emails on their own site but appear in third-party documents.

Prevent bounces: verify emails manually

Finding a CEO's email address is only part of the problem. The verification step determines whether that address actually delivers, and skipping it is the single most common cause of deliverability crashes in early-stage outbound programs.

No-tool email verification steps

The free Gmail method works for most domains:

1. Open Gmail and click "Compose."
2. Paste the email address into the "To" field.
3. Wait a few seconds.
4. If a contact profile or name auto-populates, the address likely resolves to a real inbox.
5. If nothing appears, treat the address as unverified.

Run the same test in Outlook for a second data point. An address that fails both checks should be excluded from active sequences until confirmed through another method.

Safeguard deliverability and domain health

Gmail, Outlook, and Yahoo track bounce signals at the domain level, so a bad batch from one campaign affects inbox placement for every campaign running from that domain. For teams running multiple reps on the same sending domains, one rep's unverified list can compromise everyone's results.

Instantly's campaign-level bounce protection automatically suppresses hard-bounced addresses from future sends and flags high-risk contacts before they enter active sequences. This is the safety net that manual verification can't fully replicate at scale. The email outreach plans comparison details which plan tiers include bounce protection features.

Manually spot invalid emails to halt bounces

Two patterns signal high bounce risk before you send:

• Catch-all domains: These servers accept every incoming message at the SMTP level, so the Gmail compose test shows a profile even for non-existent addresses. Test a clearly fake address (e.g., xyzabc123@company.com) at the same domain. If it "passes," treat all addresses at that domain as unverified.
• Syntax errors: Spaces, double @@ symbols, or malformed TLDs are easy to miss when copying addresses manually. Scan every address for correct formatting before importing into any sequence.

Recognizing the limits of manual CEO email discovery

The five methods above depend on publicly available data that is often incomplete, outdated, or behind a login wall. Executives change companies, update their email formats, or shift to catch-all domains with no public notice. Any list built through manual research needs re-verification before each new campaign cycle, which adds time on top of the original research effort. The Instantly guide to B2B email list pricing covers how to calculate the true cost of different data sourcing models in more detail.

Calculating your team's manual cost

Use this framework to measure whether manual research is actually cheaper than a paid tool:

Take your rep's hourly cost, multiply by the hours spent on research, then divide by the number of verified emails produced. The result is your cost per deliverable email for that session.

For a rep earning $30 per hour who finds ten emails in one hour, the direct cost is $3 per email. Industry observations suggest pattern-guessing success rates vary widely, meaning a meaningful portion of those ten addresses may not be deliverable. The effective cost per deliverable email is higher than the base calculation once you account for addresses that don't deliver, and higher still when you factor in bounce damage to your sender reputation, deliverability recovery time, and potential re-warming of affected domains.

Comparing five CEO email research tools

The gap between claimed and actual accuracy matters most for teams managing sender reputation across multiple domains. Apollo and Hunter both include SMTP verification steps. Apollo reports a 91% accuracy rate on its built-in verification process, and Hunter runs an SMTP check against the target server.

However, neither platform runs real-time verification at the point of lookup for every contact, which means a portion of results may still bounce depending on how recently the address was checked. Instantly SuperSearch verifies every contact in the database, removing the need for a separate verification step before sending.

Instantly SuperSearch covers 450M+ B2B contacts with AI-powered filtering by job title, company size, industry, revenue range, and technology stack. Instantly's deliverability network includes 4.2M+ accounts working together to protect sender reputation. Once you've built a list, launching a campaign takes one click from the same platform, removing the export-import-verify loop that manual research requires. The SuperSearch help documentation covers the full filtering and export workflow.

"In my experience, Instantly is easily the most user-friendly and effective for scaling outreach. Being able to connect as many inboxes as you need without a per-user fee is a game-changer." - Alla L. on G2

Best practices for manual email discovery

Manual research gives you control over your data sourcing process, but that control comes with responsibility. Before you send a single email from a manually built list, two things need to be in order: your legal basis for contacting each recipient, and your confidence that the address is real. The sections below cover both.

Legal risks of manual email sourcing

GDPR permits B2B cold email under the legitimate interest legal basis (Article 6(1)(f)), provided your message is relevant to the recipient's professional role, you disclose where you obtained their data, and you include a clear opt-out in every email. You need a documented Legitimate Interest Assessment for each outbound campaign.

The CCPA's B2B exemption expired in January 2023. Business contact information for California residents, including work emails and job titles, is now fully protected under CCPA, with penalties up to $2,663 per violation. The Instantly email tracking privacy and compliance guide covers both regulations in detail for sales teams.

Expected email find rate by method

Set accurate expectations with your team before assigning manual research to SDR capacity:

• LinkedIn contact info check: Visible on a portion of senior executive profiles. Worth checking first given the low time cost.
• Domain pattern detection (verified): Success rate improves meaningfully when you confirm the format from a sample employee email at the same company before applying it to the target.
• Public records (SEC, USPTO): High accuracy for public companies, near-zero for private firms with no filings.
• Website inspection: Depends heavily on company size and how actively the leadership team participates in press and IR.
• Google operators: Coverage depends on how much of a company's public presence has been indexed, including press releases, PDFs, and third-party directories. Best used to cross-check addresses found through other methods rather than as a primary source.

Safely automating manual email research with SuperSearch

Switch from manual to automated when your team consistently needs verified executive contacts at volume, when bounce rates from manually sourced lists start climbing, or when research time displaces prospecting and calling. Those are signals the research bottleneck is limiting pipeline, not protecting it.

Instantly SuperSearch automates the entire research and verification workflow. Filter by job title, company size, industry, revenue range, or technology stack, then export a verified list directly into an active sequence without leaving the platform. Waterfall enrichment runs across five or more data providers to fill gaps, and every contact is verified before it enters your campaign.

For teams ready to scale, the Instantly cold email strategy guide and the secondary sending domains playbook walk through the ramp plan for new senders, including the 30-email per inbox daily cap that protects sender reputation during scaling.

Manual research is a skill worth building. It's not a system worth relying on once your team needs to hit quota at volume. Use the cost-per-email analysis to define your trigger point for switching to verified database sourcing, then try Instantly free to filter 450M+ verified CEO contacts with built-in deliverability protection from a 4.2M+ account network.

FAQs

How do I find a CEO's email address for free?

Start by checking the "Contact Info" tab on their LinkedIn profile, then apply domain pattern detection using a confirmed employee email from the same company as your format reference. Verify any guessed address using the Gmail compose method before sending.

What is the success rate of guessing email formats without a tool?

Pattern detection works well when you can confirm the company's format from a sample employee email first. .Without that anchor, you are guessing across multiple variants, and even a correctly identified format does not confirm the address resolves to a live inbox. Unverified addresses that bounce damage your sender reputation regardless of how confident you are in the format. Verification before sending is essential.

What bounce rate will damage my domain reputation?

Hard bounce rates above 2%, sustained over multiple campaigns, trigger deliverability penalties from Gmail, Outlook, and Yahoo across your entire domain. Keep your bounce rate below 1% to protect primary inbox placement across all active campaigns.

Are manually sourced CEO emails legal to use for cold outreach?

Yes, under GDPR's legitimate interest basis provided your message is relevant to the recipient's professional role, you disclose your data source, and you include a clear opt-out. CCPA now fully protects California business contacts since the B2B exemption expired in January 2023, so document your Legitimate Interest Assessment for each campaign.

When should a sales team switch from manual research to a paid tool?

Switch when manual research is consistently limiting pipeline volume or when manually sourced lists start producing bounces that push your rate above 1%. At that point the cost per deliverable email from manual research typically exceeds $4 to $6 per contact when you account for success rate, rep time, and deliverability risk, making a flat-fee verified database the lower-cost option.

Key terms glossary

Sender reputation: A score assigned by email providers based on signals including bounce rate, spam complaints, and engagement. A low reputation causes emails to land in spam or be blocked entirely.

Hard bounce: A permanent delivery failure caused by an invalid or non-existent email address. Each hard bounce counts against your sender reputation and should be removed from all future campaign lists immediately.

Catch-all domain: A mail server configured to accept all incoming messages regardless of whether the specific address exists. These domains pass basic verification checks but can produce high bounce rates once your email is processed internally.

Waterfall enrichment: A data validation method that queries multiple providers in sequence until a verified email is found. Instantly SuperSearch uses waterfall enrichment across five or more providers to increase contact coverage without sacrificing verification accuracy.

Legitimate Interest Assessment (LIA): A documented evaluation required under GDPR for each outbound campaign that sends to contacts under the legitimate interest legal basis. The LIA records why the outreach is relevant to the recipient's professional role and how the data was sourced.

Domain pattern detection: The process of inferring a target's email address by identifying the format used by other employees at the same company (e.g., firstname.lastname@company.com) and applying that pattern to the target's name.

Read next

• How to Build a Verified B2B Email List for Cold Outreach: The Complete Playbook: A step-by-step guide to sourcing, verifying, and segmenting B2B contacts before they enter an active sequence.
• Email Warmup Guide: Clean Sending, Stronger Inbox Placement: How to ramp a new inbox from zero to full sending volume without triggering spam filters or damaging your domain reputation.
• How to Improve Your Cold Email Reply Rate: A Complete Guide: Proven techniques for improving subject lines, copy, and follow-up timing to increase replies from verified contact lists.