Over the years, resourceful email hunters have come up with all manner of search strategies. The earliest attempts relied on plain old guesswork. Later years saw salespeople spend their days sifting through hundreds of website pages and social media accounts. Today, more than 300,000 marketers and sellers use a simpler, smarter approach: Clearbit Connect.

We're recapping the history of email finding, from the first prehistoric tactics, through to today's powerful, data-driven tools.

1. Ask for Their Email

The oldest tactic in the book is also the least effective: asking for an email address.

If a salesperson was able to find a prospect's phone number, locate a company contact form, or connect on social media, they could try their luck at asking, plainly and simply, if they'd share their email address.

In a world where spam emails and phishing attacks weren't as prevalent, this approach could—occasionally—work. But today, few people are willing to offer up their personal information to a complete stranger, and asking for an email is more likely to be met with suspicion than success.

2. Intelligent Guessing

When asking for an email address failed, many salespeople would try to get lucky and guess it.

This process relied on the fact that many companies followed simple, predictable naming conventions for their email addresses:

• firstname@company.com or
• firstnamelastname@company.com

If they were lucky, finding a contact's address could be as simple as applying this email pattern. If they were after the email address of Bill Example from software.com, they might try:

• bill@software.com or
• billexample@software.com

Armed with their guesses, they could use a free service like Email Checker or MailTester to uncover a verified email, running simple diagnostic tests to see whether it was connected to a functional mailbox.

This approach sometimes worked, but because addresses that follow the firstname@company.com email format are so easy to guess, many companies started using a less obvious naming schema. That's where our next strategy came in.

3. Search Relevant Websites

Occasionally, a company will publicize individual contact details on their website. Though rare (automated scrapers can find and spam publicly listed email addresses), savvy searchers could sometimes find their desired email address on one of a handful of key website pages:

• About us pages sometimes include contact information for individual team members.
• Contact us pages will occasionally offer an email address in addition to the obligatory contact form.
• Author pages (typically found on a blog) offer another shot at finding a personal email.

If these pages failed, personal websites or portfolios (like firstnamelastname.com or about.me/firstnamelastname) would sometimes offer another shot at success.

In the likely event that their search failed to yield an email address, these pages could still provide other ways — like social media—to get in touch with a contact and begin the search again.

4. Check WHOIS Lookup

The WHOIS database provides a record of ownership for websites, including contact information for the site's registered owner. By searching for their contact's website through the WHOIS lookup service, it was sometimes possible to find a working email address.

If a contact worked at a thousand-strong enterprise company, WHOIS data would yield contact information for the domain administrator. By applying the same principle to a contact's personal website, you could occasionally track down the right email address.

This approach grew less effective over time: Services like WhoisGuard can hide a registrant's contact information, and even if you do find an email address, there are no requirements for keeping the information up to date.

5. Use an Email Permutator

Back in 2012, Distilled released a free email permutator spreadsheet, designed to systematically generate dozens of best guess email variations. Aspiring email hunters could add a contact's first name, last name, and company name, and watch 50 possible email addresses appear.

Other free tools follow a similar principle, chopping and changing the order of inputted information, adding hyphens, underscores, and other common types of punctuation to create an exhaustive list of variations. Armed with a list of possible addresses, email validators like NeverBounce or MailTester could (hopefully) pick out a legitimate email.

Done on any kind of useful scale, this process was expensive and time-consuming. Most effective email validators are paid services, costing upwards of $0.01 per email checked. If we validated 50 emails per contact, and we did this for 10 people at each of 100 target companies, we'd rack up costs of $500 — without any guarantee of finding a valid email address.

6. Use Google's Search Operators

If manual attempts to search a website bore no fruit, tenacious email hunters could enlist the help of Google's advanced search operators.

While a regular Google search will scour the entire indexed web, searches can be fine-tuned using a handful of commands. Site:example.com limits searches to pages within the example.com domain; adding quotation marks around a search term includes only exact matches; and the * symbol functions as a wild card, returning all pages that contain variations of a search term.

Using these functions, it was possible to build out a few search strings to help track down elusive email addresses:

• site:domain.com “firstname lastname” email OR contact
• site:domain.com “firstname lastname” contact
• “firstname lastname” email
• “firstname lastname” contact
• firstname “*@example.com” OR “@gmail.com”

If they were lucky, and their target email was listed somewhere on the public web, these searches—with enough time and effort behind them—could help find it.

7. Check Twitter's Advanced Search

In 2013, Twitter became one of the 10 most visited websites in the world, opening the door to another strategy for finding email addresses.

Occasionally (let's be honest—very occasionally), people share their email address in their social profiles. With a contact's Twitter handle, it became easy to sift through their tweets and find mention of an email address. Email hunters would log in to Twitter and load up their advanced search page.

They would add a contact's Twitter handle to the field labeled “From these accounts,” and add words they'd associate with an email address—email, contact me, or a website domain—to the “Any of these words” field. After hitting search, Twitter would return a complete list of every tweet that contained one of the chosen words — and hopefully, an email address.

8. Export Your LinkedIn Connections

Recent changes to LinkedIn's data privacy policies have given users the right to access all of the data they generate on the site. That includes a list of all their contacts — and their email addresses.

This feature can be used by signing in to LinkedIn, and heading to this URL. Once there, navigating through dozens of privacy options will reveal a section titled “How LinkedIn uses your data.” Just below the header, there are options for downloading contact data.

The next step is to select “Connections” from the grid of options, and hit Request archive. After reentering login details and waiting roughly 10 minutes (longer for accounts with lots of contacts), LinkedIn sends an email containing a spreadsheet of contacts data.

One of the columns contains the email address each contact has saved within their social media profiles (in the example below, I've blurred out all the real email addresses).

Though this process is great for quickly soliciting email addresses for your entire LinkedIn network (without having to rely on Sales Navigator — formally known as Rapportive), it only works for contacts: If someone refuses a connection request (or doesn't use the platform), the method won't work.