Guessing a company's email format is fine. Sending to a guess you have not verified is not. Find one real address at the company, match it to one of six common patterns, apply the pattern to your person, and verify before the first send. Done in that order, it takes about ten minutes per company and keeps your bounce rate low.
Most companies use the same format for everyone, so one confirmed address gives you the rest. The six patterns, the three-step routine, and what catch-all domains hide are all below.
The six common patterns
For a person named Tom Okafor at a company whose domain is brightmoor.example, the usual candidates are:
| Pattern | Looks like |
|---|---|
| first.last | tom.okafor@brightmoor.example |
| first | tom@brightmoor.example |
| flast (first initial + last) | tokafor@brightmoor.example |
| first_last | tom_okafor@brightmoor.example |
| firstl (first + last initial) | tomo@brightmoor.example |
| last.first | okafor.tom@brightmoor.example |
Small companies lean toward first or first.last. Larger ones tend toward first.last or flast, partly because a plain first name runs out once the company has two Toms. Treat that as a tendency, not a rule.
Step 1: find one real address at the company
You need a single address that belongs to a named person, not a role address like info@ or sales@. Look at the staff or team page, press releases (the media contact is usually named), the footer of a downloaded PDF, a signature in an email you have received from anyone there, and the "contact" mailto links on blog posts. How to find emails from a website covers the five places in nine minutes, and how to find a business owner's email address goes further for small businesses.
If you find a second address, compare them. If maria.santos@ and dev.patel@ both exist, the company uses first.last. If you find only one, treat the pattern as probable, not proven.
Step 2: apply the pattern to your person
Use the name as the company uses it. If the staff page lists Thomas Okafor, check how other staff with short names appear. The address may be thomas.okafor@ and not tom.okafor@. Watch for hyphenated surnames (some companies drop the hyphen, some keep a dot), middle initials, and duplicates, where a second Tom becomes tom.okafor2@. Check the domain too: a group may use one domain for the parent and another for a subsidiary, and the pattern can differ between them. Write down the one best guess and at most two backups, not all six.
Step 3: verify before you send
Three layers, cheapest first. First check the domain accepts mail at all: a quick lookup of its mail records (MX) shows whether anyone is listening. Second, run the candidate through an email verifier, which asks the receiving server whether the mailbox exists without sending a message. Third, for the first batch, send a handful and watch for bounces within a day. How to verify email addresses before sending goes through each layer.
One rule: never send the same message to several guessed addresses for one person to see which sticks. Every miss is a bounce on your record, and the person who gets two copies of a cold email will not answer either.
Catch-all domains and what they hide
Some company mail servers accept every address, real or not, and sort it out afterward. A verifier cannot tell a good address from a bad one there. Treat the answer as unknown. Send fewer to those domains at first, look for the pattern from step 1 as extra evidence, and consider another route (a phone call, a contact form, a LinkedIn note) for the high-value ones.
Keeping bounces low on a first send
Imogen sells commercial insurance to logistics firms. She has 40 people to write to. She finds a confirmed pattern at 31 companies and verifies those addresses. At the other 9, the pattern is unproven or the domain is catch-all. She sends the 31 over three days, 10 a day, and holds the 9. After day one, she checks: 1 bounce in 10, which she traces to a person who left the company. She pauses, removes him, and continues, ending with 2 bounces in 31. Then she tries the 9 held ones in a small batch of 5, treating each bounce as information. If you ever see more than a few bounces in a hundred, stop and fix the list; cold email bounce rate explains why.
When to find another way in
If you cannot confirm a pattern, the person is new and unlisted, or the domain is catch-all with no evidence, skip the guess. Call and ask who handles the topic; what a gatekeeper is and how to work with one gives the words. Or use a LinkedIn route: how to find an email address from a LinkedIn profile. If you are weighing a paid source, what a B2B database is includes a test to run on a sample first.
CAN-SPAM applies to cold email to businesses in the US, so give a real From name, an accurate subject, a physical address and an opt-out. This is general information, not legal advice.
Rocketship finds buyers by name and pulls verified contact details, so you are not guessing patterns by hand; a person you bring costs 1 lead and one Rocketship finds with an email costs 2, charged only when found. Rocketship finds the buyers, emails them from your own Gmail, follows up, and books the meeting on its own. Plans that get you customers start at $24.99 a month (Launch), and both Launch and Frontier start with a 7-day free trial, card required.