How to Find Business Email Addresses (Manual and API Methods)

Why business email addresses are harder to find than phone numbers

Phone numbers sit on the map listing. Email addresses usually do not. Most business directories, including the big map platforms, do not show an email field at all, so the address has to come from somewhere else: the company website, a social profile, or a guess.

That is why the task to find business email addresses splits into two jobs. First, get a reliable list of businesses with their website URLs. Second, read each website and pull out the addresses it publishes. The first job is a directory problem; the second is a crawling and parsing problem. Doing both by hand works for twenty companies and falls apart at two hundred.

Manual method: where the address usually hides on a website

For a handful of contacts the manual route is fine, and it shows what an automated tool has to do. Open the homepage and check these places in order:

1. The footer. Many small businesses print a general mailbox next to the phone number and address.
2. The contact page. Look for a link named Contact, Contact us, Get in touch, or the local-language equivalent. Some sites put the address in the page text; others only offer a form.
3. Legal pages. Imprint, Impressum, Mentions légales, Terms and Privacy pages often contain a contact address because local law requires one.
4. Mailto links. Even when the visible text says "Email us", the underlying link often carries the real address. Hover over it or view the page source and search for mailto:.
5. Job and press pages. Larger companies publish careers@ or press@ mailboxes there.

Write the address down together with the page you found it on. When you later verify or remove a contact, knowing the source page saves time.

Manual method: guessing patterns, and why it goes wrong

The classic company email lookup trick is to work out the naming pattern from one known address and apply it to every employee: first.last@, first@, flast@. It produces an address for everyone, which is why it is popular and why so many outreach lists bounce.

A guessed address has never been confirmed to exist. Some companies use several patterns at once, some retire mailboxes when people leave, and a growing share of domains accept any address at SMTP time and discard the unknown ones later, so even a delivery test cannot tell you the mailbox is real. If you do guess, treat the result as a hypothesis and verify it before it enters a campaign.

There is a second problem with pattern guessing: it targets individuals. A named mailbox is personal data in the EU, the UK and a growing list of other jurisdictions, which changes what you are allowed to do with it. A general mailbox that the company itself publishes for enquiries does not carry the same weight. This is not legal advice, but it is the reason the rest of this article focuses on role mailboxes.

Which addresses to keep and which to drop

The table is the filter Locomint applies at extraction time, before a response is built. It is a reasonable default for any b2b contact data project.

RFC 2142 standardised info@, sales@ and support@ in 1997, which is one reason so many small businesses still use them. Contact points published for business purposes are also what the removal and opt-out rules on our privacy page are built around.

How to find business email addresses with an API

The automated route follows the same steps as the manual one, but a machine does the reading. With Locomint it is two calls: search for businesses in a place, then request the full record for each one. The full record includes an enrichment block that the API fills by fetching the business homepage, following one link to the contact page when the homepage gave no email or WhatsApp, and extracting the contact points it finds.

Start with a search. Write the location as "City, Country": in our canary runs a bare "Warsaw" resolved to Warsaw, Indiana.

curl "https://api.locomint.io/v1/places/search?q=accountant&location=Manchester,%20United%20Kingdom&limit=20" \
  -H "X-API-Key: $LOCOMINT_KEY"

Each result carries a place_id and, where the business lists one, a website. Then fetch the details for every result that has a website. The example below uses Python with httpx and prints the role mailboxes found.

import httpx

API = "https://api.locomint.io/v1"
headers = {"X-API-Key": "lm_free_your_key_here"}

with httpx.Client(base_url=API, headers=headers, timeout=30) as client:
    search = client.get("/places/search", params={
        "q": "accountant",
        "location": "Manchester, United Kingdom",
        "limit": 20,
    }).json()

    for summary in search["data"]:
        if not summary.get("website"):
            continue
        place = client.get(f"/places/{summary['place_id']}").json()
        enrichment = place.get("enrichment") or {}
        print(place["name"], enrichment.get("website_status"),
              enrichment.get("emails", []), enrichment.get("contact_form_url"))

The full field list is in the details reference. Three fields matter most for email work:

• enrichment.emails: role mailboxes on the company domain. Person-named addresses and unrecognised off-domain addresses are dropped before the response is built, so you never store them by accident.
• enrichment.website_status: ok, unreachable, parked, redirect_social or no_website. A parked domain or a site that only redirects to a social profile will never yield an address. unreachable also covers a site that answered the first request with a 403; Locomint treats that as a block and does not retry through another route.
• enrichment.contact_form_url: when the site offers a form instead of an address, this tells you where it is, so a human can still reach out.

Extracting emails from websites you already have

When the companies are already in your CRM, skip the search step. The website extraction endpoint takes up to 20 page URLs per call (http or https with a real host name, or the whole call is a 400 invalid_request) and returns the readable content of each page with the same contact block: emails, socials, whatsapp, contact_form_url and tech_stack.

import httpx

resp = httpx.post(
    "https://api.locomint.io/v1/websites/extract",
    headers={"X-API-Key": "lm_free_your_key_here"},
    json={"urls": ["https://example.com/", "https://example.com/contact"],
          "output": "text"},
    timeout=60,
)
for row in resp.json()["data"]:
    print(row["status"], row.get("emails"), row.get("contact_form_url"))

Pass the homepage and the contact page as two URLs when you know both; it costs two credits and catches the address that only appears on the contact page. The row status says why a page produced nothing: thin means the page is rendered client-side and carried almost no text, parked means the domain is for sale, unreachable means the server did not answer in time, and blocked means it answered with a challenge, which ends the fetch. Pages Locomint refuses to fetch (private or non-web addresses, refused) cost nothing.

What an email finder cannot see

Three cases return no address however good the crawler is.

• Addresses shown only as images, or assembled by JavaScript after the page loads. Locomint reads the HTML as served and does not run scripts, so a contact page built entirely client-side comes back empty.
• Sites that answer a plain request with a 403 or a challenge. Locomint reads public pages at a conservative rate and stops when a site says no; it never routes around a challenge or a login.
• A published address that is dead. Businesses change providers and forget the footer. That is what verification is for.

Verifying before you send

Every address you collect, by hand or by API, goes through verification before it enters a mailing tool. The verify endpoint checks syntax, looks up the domain's MX records, flags disposable and free providers, detects catch-all domains, and, where the mail server cooperates, confirms the mailbox at SMTP level without sending a message. It accepts up to 100 addresses per call at one credit each.

curl -X POST "https://api.locomint.io/v1/emails/verify" \
  -H "X-API-Key: $LOCOMINT_KEY" -H "Content-Type: application/json" \
  -d '{"emails": ["info@example.com", "sales@example.com"]}'

Keep deliverable rows, review risky rows (the domain accepts everything, so the mailbox cannot be confirmed) and unknown rows (the server would not answer), and drop undeliverable, invalid and disposable. The article on how an email verification API works goes through each check and what its flags mean.

Where to start this week

Pick one category and one city, for example "dentist" in "Lisbon, Portugal". Run the search with limit=50, fetch details for the results that list a website, and count how many came back with at least one role mailbox. Verify that set. You now have a small clean list and a yield figure for your market, for well under 200 credits.

The free plan covers 200 credits a month, enough for that experiment with room to repeat it in a second city. If the yield justifies it, the paid plans on the pricing page raise the monthly credits without changing the workflow. For the steps on either side of the email step, read the guide to local business lead generation.

Frequently asked questions

Is it legal to collect business email addresses from websites?

Collecting a role mailbox that a business publishes on its own website, such as info@ or sales@, is generally treated as business contact data rather than personal data, but the rules on sending to it still apply: identify yourself, offer an opt-out, and honour it. Named mailboxes belong to a person and fall under stricter privacy rules in many countries. This is not legal advice; check the rules for the countries you send to.

Why does the API return no email for a business that has a website?

The most common reasons are that the site only offers a contact form, that the only address on the site is a personal mailbox which Locomint drops by design, that the site could not be reached within the crawl budget, or that the page is rendered entirely in JavaScript. Check enrichment.website_status and enrichment.contact_form_url in the same response to see which case applies.

How often is the email data refreshed?

Website enrichment is cached per site for 30 days. If you need a fresh crawl sooner, call the details endpoint with refresh=true, which costs one extra credit and re-reads the website immediately.