How to Find a Candidate's Email Address: 7 Methods Recruiters Use in 2026

You can find candidate email addresses in seven reliable ways: check your own records, ask through a short message, read the candidate's own site, infer a work-email pattern, use an enrichment tool, find a published contact route on developer profiles, or get a warm introduction. The harder part is what comes next. A wrong address bounces, hurts your sender reputation and can break privacy rules.

This guide ranks each method by effort and risk, shows how to verify an address before you send, and explains the legal lines that apply to recruiters. It is written for recruiters, sourcers, agency owners and founders who send their own outreach.

Table of Contents

• 7 ways to find a candidate's email address
• Methods compared
• How to verify an email address before you send
• The rules: GDPR, CAN-SPAM and GitHub
• Common mistakes
• FAQ

7 ways to find a candidate's email address

1. Search your own ATS and CRM first

Past applicants, silver medalists and old sourcing lists often hold working addresses. Search by name and current employer before you pay for anything new. Records go stale, so treat an old address as a lead to verify, not a fact. Our guide to candidate enrichment explains how to refresh incomplete records.

2. Ask for it in a short message

If you reach a candidate on a professional network, a two-line note that asks for the best address to continue the conversation works for interested people. It is slower than a lookup, but it is the cleanest option for consent. The person chooses the address and the channel.

3. Check the candidate's own site and profiles

Many engineers, designers and consultants publish a contact page, a portfolio footer or a link-in-bio page. An address listed there for professional enquiries is a deliberate invitation. Use it, mention where you found it and keep the first message short.

4. Infer the work-email pattern, then verify it

Companies usually follow one format, such as [email protected]. If you know the pattern from other staff, you can build a likely address. Never send to a guess. Verify it first, and consider whether a work address is the right place to pitch a job. Some candidates dislike recruiter messages landing in an employer-managed inbox.

5. Use an email finder or enrichment tool

Finder and enrichment tools return an address from a name, company or profile link. Vendors often advertise accuracy between 90% and 98%, according to Instantly's testing guide, but Instantly sells email tools and says accuracy figures mean little without verification. Run your own sample.

Credit costs differ by tool. On ConnectDevs, an enrichment costs 5 credits, per its pricing page. Its enrichment feature adds available contact routes and keeps the source, observation date and confidence level for each field. It also states that contact data needs checks for validity, permitted use and opt-out handling before you rely on it.

6. Use developer profiles for evaluation, not for scraping addresses

GitHub, Stack Overflow and similar sites are good places to judge engineering work. They are poor places to harvest addresses. GitHub's Acceptable Use Policies say you may not use information from the service "for spamming purposes, including for the purposes of sending unsolicited emails to users," or sell personal information "to recruiters, headhunters, and job boards." In February 2026, a GitHub staff member said in a Hacker News thread, as reported by GIGAZINE, that scraping commit emails violates its terms and that GitHub bans accounts that do it. Our walkthrough on finding passive candidates beyond LinkedIn shows safer ways to reach developers.

7. Get a warm introduction

A referral from a current colleague, a community organizer or a former manager beats any lookup. Ask your team who knows the person. Introductions take longer, but they lift reply rates because the candidate already trusts the sender.

Methods compared

Method	Effort	Main risk	Best for
ATS or CRM search	Low	Stale data	Rediscovery of past candidates
Ask in a short message	Medium	Slow, low volume	Senior or hard-to-reach talent
Candidate's own site	Low	Not always listed	Engineers, designers, consultants
Email pattern guess	Medium	Bounces, work inbox	Targeted, low-volume outreach
Finder or enrichment tool	Low	Accuracy varies by vendor	Volume sourcing
Developer profiles	Medium	Platform policy and privacy rules	Evaluating work, not harvesting contacts
Warm introduction	High	Depends on your network	Priority hires

How to verify an email address before you send

Email verification checks whether a mailbox is likely to accept your message before you send it. A verifier asks the receiving server about the address. That check has a known gap, which is accept-all (catch-all) domains.

A Hunter guide to accept-all addresses explains why. These domains say yes to every address, including ones that do not exist, so a verifier cannot tell real from fake. In Hunter's test, the accept-all segment bounced at 27%, compared with 1% for a control group. Hunter is an email-finder vendor, so read the numbers as directional.

Use this routine:

1. Sample first. Verify 50 to 100 contacts and review the split between valid, invalid and accept-all results.
2. Segment by confidence. Send to high-confidence addresses first. Hunter suggests capping low-confidence addresses at 2% to 5% of a list.
3. Cross-check. Match the address to a second signal, such as the candidate's current employer or a site that lists the domain.
4. Watch bounces. Hunter recommends keeping the bounce rate under 2%. Suppress any address that hard-bounces and never retry it.
5. Re-verify old data. Contact data decays. Instantly cites research that puts annual decay anywhere from 22.5% to 70.3% for B2B contacts, so refresh before each major campaign.

Send from a mailbox you own, not a throwaway domain. ConnectDevs Pilot sends campaigns from your own Gmail address and tracks opens, replies and bounces, so you can see list quality as it happens. For tactics on the message itself, read our guide to recruiter outreach response rates.

The rules: GDPR, CAN-SPAM and GitHub

This section is general information, not legal advice. Check with counsel for your region and use case.

GDPR: tell people where you got their data

If you collect data about someone in the EU or UK from a source other than the person, Article 14 of the GDPR requires you to provide specific information within a reasonable period and at the latest within one month. If you use the data to contact the person, you must provide it no later than the first contact. Put your identity, purpose and source in the first message.

CAN-SPAM: applies to commercial email, with no B2B exemption

The FTC's CAN-SPAM compliance guide says the law "makes no exception for business-to-business email." It requires accurate sender details, a non-deceptive subject line, a valid postal address and a working opt-out honored within 10 business days. Each non-compliant email can draw a penalty of up to $53,088. Whether a given recruiting email counts as commercial is a question for your lawyer, but a postal address and an easy opt-out cost almost nothing.

Platform terms

Beyond the law, platform rules matter. GitHub's policy above is one example. LinkedIn and other networks have their own terms on data collection. Read them before you automate anything.

Common mistakes

• Sending to unverified guesses. A burst of bounces damages your domain's reputation.
• Treating reachable as interested. Having an address does not mean consent to every channel.
• Pitching a personal contact on a work inbox. Choose the channel the candidate would expect.
• Skipping the source line. Tell people where you found their details. It builds trust and meets GDPR duties.
• Never refreshing data. Last year's list is already partly wrong.

FAQ

How do recruiters find candidate email addresses?

Recruiters search their ATS and CRM, ask candidates directly, check personal sites, infer work-email patterns, use enrichment tools, or get introductions. The best choice depends on volume and how much risk you accept.

Is it legal to email candidates you found online?

Often yes, but rules vary by country. GDPR requires you to disclose your source, CAN-SPAM requires an opt-out for commercial messages, and platforms such as GitHub restrict how their data can be used. Ask a lawyer for your specific case.

How accurate are email finder tools?

Vendors often claim 90% to 98% accuracy, but those numbers come from the sellers. Test a sample of 50 to 100 contacts, verify them with an independent tool and measure your own bounce rate.

What is a good email bounce rate for recruiting outreach?

Keep it under 2%. Hunter recommends that ceiling, and Instantly suggests a 1% internal target to leave a buffer. Suppress hard bounces permanently.

What is an accept-all or catch-all email address?

It is an address on a domain that accepts mail for any mailbox, real or not. Verification tools cannot confirm these addresses, so they carry a higher bounce risk.

Should I email a candidate at their work address?

Use caution. A work inbox is managed by the employer, and many candidates prefer a personal or professional-network channel for job conversations. If you do use it, keep the message discreet.

Conclusion

The best way to find candidate email addresses is to combine methods: search what you own, use a published contact route when one exists, verify everything and log the source. Skip scraping, test small before you scale and keep your bounce rate low.

Want contact routes and candidate context in one place? Explore ConnectDevs candidate enrichment and test it on a short list from a live role.