How to Find a Recruiter's Email Without LinkedIn Premium: The Free Method

You've spotted a company you want to apply to. On LinkedIn, you've identified the right person to send your application to: the head of marketing, the agency director, or the HR manager. You just need their email address. LinkedIn doesn't show it directly (unless you pay for Premium or Sales Navigator), and you'd rather not spend €40 a month for occasional use.

Good news: finding a decision-maker's professional email almost never requires a paid tool. Three simple techniques, combined, let you find the exact address in 80% of cases — in under five minutes per contact.

Understanding how professional emails are structured

A company with its own domain (like some-agency.com) almost always follows a naming convention for internal emails. Five patterns dominate: firstname.lastname@domain.com (the most common), f.lastname@domain.com, firstname@domain.com (typical of teams under 10 people), lastnamefirstname@domain.com, and more rarely initials@domain.com.

If you know the pattern the company uses for one person, you know the pattern for all their employees. How do you find the pattern? Three methods.

First, check the "About" or "Team" page on the company's official website. Many companies display their members' email addresses. A single address is enough to reveal the pattern.

Next, search Google for emails already published online. Try "@theirdomain.com" filetype:pdf or "@theirdomain.com" site:linkedin.com. Online CVs, press releases, and professional contact lists often contain a sample address.

Finally, some free email finder tools (Hunter free tier, Apollo free, Snov free) give you the pattern for a domain in seconds — without even needing to look up a specific name. If you want to understand what an email finder is and how it works, there's a detailed breakdown here.

Finding the right first and last name

LinkedIn remains the most reliable tool for identifying a specific person at a company. You don't need Premium: the free basic search works. Filter by company and job title ("HR", "Recruiter", "Talent Acquisition", "Manager"), and you get the relevant list. This same filtering logic also works for building an HR contact database across an entire sector, not just a single contact.

If LinkedIn doesn't show the exact profile, or if you need to verify a full name, cross-check with other public sources. The "Legal Notice" page of the website often lists the company director's name. Official directories like the INSEE Sirene business registry identify the legal representative. For media companies, the masthead (the published list of journalists and their roles) is public.

Building the candidate email in seconds

Once you have the name (Sophie Martin) and the company's pattern (firstname.lastname@domain.com), the candidate email is sophie.martin@some-agency.com. Done.

The trap: sending that email without first checking it actually exists. If Sophie left the company six months ago, your email bounces. If the real pattern is slightly different (for example s.martin for sales, sophie.martin for HR), you'll miss too.

Hence the next step: verify without sending.

Checking that an email exists without sending a message

Several free tools let you test an email address before using it. Hunter's free tier verifies a certain number of emails per month. NeverBounce and ZeroBounce also have free quotas. Mailtester.com does one-off free verification with no sign-up required.

The technical principle: these tools send an SMTP command to the receiving server, which responds with "this mailbox exists" or "this mailbox does not exist" — without any real email being sent. The recipient sees nothing. This is the step that lets you test an address's deliverability before sending and filter out bounces.

For 1 to 10 emails per week, the free tiers are sufficient. Beyond that, you either pay a subscription (typically €30–50/month for reasonable volumes at Hunter or Snov), or you use an all-in-one tool in alpha access that includes verification in the pipeline.

When LinkedIn isn't enough: other channels

Some profiles can't be found on LinkedIn or hide their names. Three complementary sources.

Twitter/X: many professionals display their work email in their bio, especially journalists, freelancers, and CEOs of small companies. A simple search by name + company is enough.

GitHub for tech profiles: developers often leave their email in commits or their public profile.

Personal websites and blogs: an independent consultant, a freelance journalist, or a founder who blogs — their professional email is almost always on the contact page or in the footer.

The "found the email" trap that ends up in spam

Having the email isn't enough. If you send ten applications from your Gmail account, pasting the same message each time, within five minutes, your sending domain will be flagged and half your messages will go to spam — including those sent to perfectly valid addresses.

Three rules prevent this. Personalize the message (at least two sentences that show you actually looked at the company). Spread out your sends (5 to 10 messages per hour max, not 50). Always check deliverability before sending to avoid accumulating bounces that damage your sender reputation.

How long it actually takes

For a single email to find (one specific recruiter at one specific company), budget 3 to 5 minutes using the manual method, verification included. For 50 emails, that climbs to 2 to 4 hours. For 200 emails, you're looking at 8 to 12 hours — that's when an integrated scraping and email finder tool becomes relevant.

The trade-off is the same as for large-scale cold outreach: if you're looking for one email every six months, do it manually. If you're tracking down 50+ per month, a free alpha all-in-one tool will save you dozens of hours at no subscription cost.

This article is part of a broader series: see the guide to prospecting without a SIRET number.

FAQ — Finding a professional email without a subscription

How do I find a recruiter's email without LinkedIn Premium?

Three steps: identify their name using the free LinkedIn search, figure out the email pattern for their company (by checking the "Team" page on the website or using a free email finder like Hunter), build the candidate email (firstname.lastname@domain.com), and verify it exists using Mailtester or Hunter free.

Hunter, Apollo, Snov: which free email finder should I choose?

Hunter offers 25 free searches per month and a solid domain pattern explorer. Apollo has a more generous quota but its non-US database is thinner. Snov works well for US/UK emails, less so for European addresses. For occasional low-volume use, Hunter free is the most practical option.

Is it legal to find and use a professional email without the person's consent?

For a professional email published publicly (on a website, a contact page, a press release), yes — under the legitimate interest basis recognized by the CNIL (France's data protection authority) and consistent with GDPR. Provided you identify yourself as the sender, offer an opt-out (the person can ask to be removed from your list), and avoid harassment. For cold applications to a publicly listed professional email, the legal framework is clear.

What email pattern do agencies in France typically use?

The dominant pattern in France is prenom.nom@domaine.fr (60–70% of cases). Next comes prenom@domaine.fr (typical of teams under 10 people, ~15%), then p.nom@domaine.fr (~10%), with the rest split across rarer variations. When in doubt, test the three dominant patterns.

How many emails can I verify for free per month?

Combined, the free tiers of Hunter (25/month), Snov (50 initial credits), and Mailtester (unlimited but without sign-up) let you comfortably verify 50 to 100 addresses per month for free. For higher volumes, stacking paid plans or using an all-in-one alpha tool becomes more cost-effective.

Is an email finder 100% reliable?

No. No tool guarantees 100% accuracy. The best services claim 90–95% reliability on well-maintained databases. For less common emails (SMEs, niche organizations), reliability drops to 70–85%. The rule: always verify deliverability before batch sending to eliminate bounces.