How to find any decision-maker's email in under 90 seconds

Finding a verified work email for a small-business owner is not hacking, sourcing, or scraping. It's a four-step process that takes 90 seconds done manually - and is the difference between a 30% open rate and a 65% one. Here is the process, the seven patterns that cover 92% of SMBs, and exactly how to verify without pinging their inbox.

Step 1 - Find the name (20 seconds)

Before a pattern, a domain, or a verifier, you need a first name and a last name. For >80% of SMBs under 50 employees, the owner or practice manager is publicly named on at least one of these:

• The website's "About" or "Team" page - the fastest hit. Bookmark it in your workflow.
• National company registry - Companies House (UK), INPI/KBIS (France), SIRENE (France), Handelsregister (DE/NL), state Secretary of State (US). Always lists the legal owner and, usually, an address.
• LinkedIn company page- click "People" and filter by the business name. Owners and managing directors surface first.
• Signed Google review responses- SMBs almost always reply to 5-star reviews, usually with the owner's first name. Gold for freelance practices.
• Domain WHOIS- often redacted now, but still occasionally reveals the registrant's real name on older domains.

Step 2 - Lock the domain (5 seconds)

The business website is almost always the email domain. Two caveats worth checking:

• If the site is a free subdomain (yourdentist.wix.com, .squarespace.com, .wordpress.com) - they don't have a business email on that domain. Look for a custom domain mentioned in the footer, or accept you'll be reaching out via a personal Gmail (rarely worth it).
• If MX records point to Google or Microsoft 365, the domain is set up correctly for business email. You can check MX via any free DNS tool; we do it automatically in the free verifier.
• Chain/franchise businesses - local branches often share a corporate domain. The decision-maker for the branch may not have an email on that domain. Target the franchise owner at the parent instead, and reference the specific branch.

Step 3 - The seven patterns (30 seconds)

Across 2.4M verified SMB emails in our database, these seven patterns cover 92% of all work addresses. The hit rate column is the share of SMBs where each pattern is valid, in descending order of usefulness.

1. first@domain - 41% hit rate. Dominant for solo practitioners: dentists, therapists, lawyers in single practice.
2. first.last@domain - 28%. Dominant for 3+ employee firms.
3. firstlast@domain - 9%. Common in the US and Canada.
4. f.last@domain - 6%. Common in older French and Dutch SMBs.
5. firstl@domain - 4%. Less common but non-trivial in hospitality and trades.
6. last@domain - 3%. Classic European eponymous law firm / medical practice pattern.
7. first_last@domain - 1%. Almost always enterprise bleed-over; rarely the right pattern for SMBs.

The "other" 8% are catch-alls, personalised aliases, or role addresses. More on those below.

Step 4 - Verify without pinging (30 seconds)

Sending to an unverified address is the single fastest way to burn sender reputation. Here's how to verify without actually delivering a test email, which would leak your intent and risk bounces.

Syntax check

Every verifier starts here. Must be well-formed (matches name@domain.tld), no obvious typos (gmial.com, yahooo.fr), no prohibited characters. Rules out ~3% of candidates instantly.

MX record lookup

DNS query for the domain's MXrecords. If there isn't one, the domain can't receive mail - junk. If MX points to a known business provider (Google Workspace, Microsoft 365, Zoho), that's a strong positive signal the email exists at a real inbox.

SMTP handshake (no data sent)

Open a TCP connection to the mail server and run MAIL FROM + RCPT TO commands. The server will return a code indicating whether the mailbox exists. You then send QUIT before any actual data leaves. No email is delivered; the server never sees a subject or body. This is what every professional verifier does under the hood.

Catch-all detection

Some domains accept every address that gets sent to them, regardless of whether the mailbox actually exists. These return "valid" on SMTP check for literally anything - including a random 20-character string. A good verifier probes with a known-fake address first; if that "exists," the domain is catch-all and any positive result is unreliable.

Edge cases that trip everyone up

Role addresses

info@, contact@, hello@, sales@- these deliver, but usually to an assistant or a shared inbox where cold emails go to die. Reply rate is ~5x lower than a named owner's address. Use only as a last resort, and when you do, address the email to the role explicitly in the copy ("Whoever manages bookings at {{business}}").

Assistant-guarded addresses

For practices with a front-of-house or EA, emails to the owner sometimes land with the assistant first. Subject line matters more here - one that sounds like peer-to-peer correspondence (not a pitch) gets forwarded up. Avoid: "Quick question about {{business}}". Try: "Saw {{first_name}}'s reply on Trustpilot".

GDPR / PECR exposure

In the EU and UK, B2B cold email is legal without prior consent, as long as the recipient's email is a professional address and you include a one-click unsubscribe plus a clear sender identity. Personal addresses (Gmail / Yahoo) used for work are a grey zone - safer to skip. Full GDPR breakdown.

Automating the whole pipeline

Done manually, each lead takes 90 seconds. Across 800 leads a month that's 20 hours - which is fine until you're running three inboxes. At that point the cost of manual sourcing exceeds the cost of a verifier subscription.

Prospea runs the full four-step pipeline at volume: name lookup from business signals, domain resolution, pattern testing against seven candidates, full syntax + MX + SMTP + catch-all verification. Every email you see in Prospea has already passed verification. Try the free verifier for a one-off check - or spin up a campaign for the full flow.