by Theo Strauss

How to find any CEO’s email address in minutes

The Emailer’s Guide To The Galaxy: Part I

How do I find that CEOs email?

I’m 17, so my network isn’t too big, just yet. For me, cold emails are the easiest and most direct way to reach a founder. Over the past year, I’ve found out not only how to find a tech leader’s work email address, but their personal one as well.

In this post, I’ll teach you the ins and outs of searching for anyone in tech’s email address. So, sit down, download Google Chrome, open your Gmail, and let’s get to work.

Part 1: The easy way out

The easiest email to find is a work email, but this is a double-edged sword. Although easier to find, this person could have:

  1. hundreds upon hundreds of emails flooding their inbox every day
  2. a filter to weed your email out, or
  3. an executive assistant (EA) to personally select the emails they should read.

If this is a strictly business-related email, or you know this founder doesn’t receive over 400 emails a day, the method described below is the right one for you.

Remember, emailing is all about respect, so weigh the two options carefully. Does this person want you to email them in their personal inbox?

Step 1: Finding an email using Hunter.io

Go to the Hunter website and sign up for an account (also download their plug-in for Chrome).

Hunter is an insanely powerful tool. We’re going to use it in more than one way in this post. It allows you to find all emails attached to a certain website, verify that an email is accepted by their server, and even stores your leads for later.

Step 2: Search for the relevant information

Go to your Hunter dashboard and Search for the information you’re after. You can type in the website of your person’s company. Hunter conveniently finds all the emails associated with the server.

Your person’s email might not be there, but what’s important is the pattern you find. It most probably would be any of the patterns below:

  • [first_name]@company.com
  • [first_initial][last_name]@company.com
  • [first_name][last_name]@company.com.

Now that you have a pattern, it’s time to try it out.

Step 3: Verify the email in Hunter

Go to the Verifier tab in Hunter:

Type in what you think your person’s email is via the pattern. You’ll see one of three results.

  1. The server accepted the email address ✅
  2. The server accepts all email addresses ✅
  3. The server rejected the email address ❌

If it’s #3, you’ve hit a snag. You should probably skip to Part 2: The hard, but tried and true way out.

If it’s #1 or #2, you’re on the right track. Time to go to your Gmail account!

Step 4: Double-checking your email

We’re going to double check if the email we’ve found is actually valid using an underrated feature of Gmail. At this point, we’re at the last step. Create a new draft and type in the email that you tried in Hunter.

If you press enter and hover over the email you typed in, you’ll see a slot for a profile picture and a space for their name pop up.

If you see a profile picture and can verify it’s your person, you’re good to go. If you see a name, and it’s the one you want, even better! And, if none of that is true, try to copy and paste the email address into a Google Search. Something may well come up that verifies your guess.

Look, it’s me!

If a profile picture comes up, but you’re not sure it’s them, go back to Google and search their name. Head over to Images and see if you can find that picture. You probably will and it’ll be attached to one of their accounts, maybe an old Twitter profile picture or something.

Still can’t find the photo? Screenshot the little profile picture on Gmail and drop it into Google Images to do a reverse image search. It might give you the results you were looking for!

Step 5: Send your email away!

WAIT, don’t! Before sending, you should read the next post in this series, How to design a cold email for a CEO with a 100% read, click, and response rate.

Now, if none of that worked, don’t worry one bit. Let’s get to the good stuff.

Part 2: The hard, but tried and true way out.

So, you’ve not been able to get into a CEO’s personal inbox, untouched by filters, executive assistant, or more than 100 emails a day.

Unlike what most people think, this is super easy. It’s all about not giving up.

Here’s what you’ll need: a LinkedIn account, a Hunter account, Google Chrome, and 5 mins to half an hour.

Step 1: Find their LinkedIn

You can either open Google and try to type in their name (followed by their company too if they have a common name) or search LinkedIn directly.

So, why LinkedIn? This can be a gold mine of information.

As CEO’s rise up, they might forget to update their LinkedIn, keeping their personal links in their contact info.

Step 2: Click on their contact info

If you’re lucky, and they’ve forgotten to update their LinkedIn profile, their personal email might even be there too.

One of two things will happen:

  1. You’ll be taken to their personal site.
  2. You’ll hit a “DNS not found” page.

If #1 happens, you’re on the right path. Look at the nav bar of the site for a Contact page or scroll to the bottom to find an email icon or even better, the email itself.

Finding a [first_name]@domain.com or [email protected] email is great. Those always will redirect to their personal email.

If you can’t find an email or even something that says “my first name at my full name dot com”, but you can find a contact form, that’s fine too. I say it’s “fine,” because you just won’t be able to track your email’s progress, which I’ll get into in the last post of this series. But, these almost always go to their personal email, so go for it if you want to get your email out there!

If #2 happens, that’s still OK. This is when you whip out the directory of the Internet, c/o Sir Tim Berners Lee and Vint Cerf.

Step 3 (kind of): Head over to WHOIS.com

This is a step we might refer back to a couple times. Go to your URL/search bar at the top of Chrome and type in whois.com/whois/[their_domain].

When the Internet was starting up, DARPA (the government body which founded the early version of it) needed a place to store the information of domain owners. A ton of people who buy domains, commonly off of GoDaddy.com (I highly recommend that you use Google Domains instead, by the way), don’t utilize domain privatization, which puts their personal info all out there.

Google Domain offers domain privatization for free!

If you see all of their info and not something like the photo above, you’re in luck. Scroll until you’ve found what you’re looking for.

If that’s not that case, don’t worry.

Step 4: Looking for a username pattern

Something many people do, but don’t think about often, is use the same username across every social media account.

Using this realization, your next task is to pull up all of their social media you can find. Unless they’re a social media OG like Jack Dorsey who has @jack everywhere, you’ll find your key to success.

Look at the URL in each. Both usernames are @theostrauss

Pull up at least two accounts. The first should be Twitter, the second can be either Instagram, Facebook, or LinkedIn to see if they have a username on the last two (which are optional when signing up).

Now, we can repeat Part 1, Step 4. Go to Gmail and type in their username @gmail.com. Use the steps to figure out if it’s valid. If it’s right, you’re ready to email!

Step 5: Try the guessing game before going all out

If that didn’t work, you might as well try something else while you’re on Gmail.

The clues Gmail gives you are a crucial piece of the puzzle. The second easiest way to exploit that feature is to guess the most common email patterns until you’ve brute forced your way in. Here they are:

  1. [first_name][last_name]@gmail.com
  2. [first_name].[last_name]@gmail.com (this is actually the same email as the last one, Gmail doesn’t care about periods, period.)
  3. [first_name]_[last_name]@gmail.com
  4. [first_initial][last_name]@gmail.com
  5. [first_initial][middle_initial][last_name]@gmail.com

Now, a few people might have the same name as the founder you’re trying to reach out to. So, you have to be sure it’s the right person by using all the steps in Part 1, Step 4.

If none of those steps work, you’ve hit the last and probably most uncommon step that you’d resort to, but it’s the best option at this point.

Step 5: Goooooooooogle

Go back to our trusty friend, google.com, and type in the person’s name (and their company’s name if their name is pretty common). Now, start scrolling.

Once, it was on the 3rd page of Google where I found a writer’s about.me which had a link to an old Tumblr, which had a link to an old Twitter, which used a username that his Gmail did too.

Here, I wish you all the best of luck. It’s up to you and you’re very close to finding your founder’s email. But, if all else fails, you can always revert back to Part 1.

Part 3: Where to go from here

Now that you have the email address you were looking for, you have to write the email!

My next post in this series will cover how to write emails that have landed me a 100% read rate, 100% click rate, and 80% response rate.

If you liked this post, hold down that ? icon (you can go up to 50, you know). Stay tuned for the next post and the one after that, which will go into tracking the progress of your email.

Follow my Medium to learn more about design from a new perspective, literally. For the next few months, I’m diving into how design will intersect with the future. On this page, you’ll see case studies looking into self-driving cars and posts highlighting interfaces that are breaking boundaries in the world of UI/UX.

You can also catch me on Instagram @theostrauss and on Twitter @theodorestrauss!