How to Find the Company Behind an Email Address

Last updated: 2026-10-19 · Tested by Derrick on 1,000 EU + US work emails.

Finding the company behind an email means starting from a work email address (e.g. jane@acme.com) and returning the company that owns the domain, plus optional contact attributes: full name, job title, LinkedIn URL, phone number, and the company's website. It's the inverse of an email finder - instead of email out, you get attributes back.

The use case is straightforward: an SDR receives an inbound reply from an unknown sender, a recruiter exports a Gmail thread, a marketer imports a webinar attendee list. Each row has an email but no company context. According to the Salesforce State of Sales 2025, sales reps spend 27% of their time researching prospect data - most of which starts with an email and ends with a manually-built company profile.

What finding a company from an email really means

Finding the company is the bridge between a raw contact list and a list you can actually sell to or hire from. An email on its own is just a routing address. The company behind it - its name, size, industry, and website - is what tells you whether the contact is in your ICP, which playbook to run, and how to personalize the first message. Teams that skip this step end up either ignoring good leads or burning them with generic outreach.

The cost of doing it by hand adds up fast. At 27% of a rep's week spent on research (Salesforce, 2025), a single SDR working a 500-row inbound list can lose a full day copy-pasting domains into Google. Reverse lookup collapses that into one column in a spreadsheet, which is why it has become a standard step in modern lead email finder workflows.

To see what a single address gives you before reading further, paste it into our free reverse email lookup: it runs in your browser and returns the domain, the type of address and the name read from its pattern.

What an email address already gives you for free

This split is the thing the free widgets on this search results page do not tell you, and it changes what you should pay for. When a tool charges a per-lookup rate to return a company name, it is charging a probabilistic price for a deterministic fact: jane@acme.com belongs to acme.com and no database is needed to establish that. The genuinely uncertain step is narrower than the marketing suggests.

Derrick splits its own pricing along that same line, which is why the deterministic half costs nothing: Find Names & Domains by Email Addresses is unlimited on every plan, including the free one, because reading a domain and a name convention is arithmetic rather than a database query. The probabilistic half, Email Finder at 5 credits and billed only when an address is actually found, is where the matching happens.

The free tool above reads that split for any address you paste: run it on one of your own before you buy anything.

The addresses that will never lead to a company

Two families of address return nothing, and no vendor changes that. Sorting them out before you run a batch is what keeps a match rate honest, because a list padded with unresolvable rows makes every tool look broken.

Role addresses have nobody behind them

contact@, info@, sales@, hello@, support@, jobs@, noreply@: these are shared mailboxes by design, routed to a rotating group or to a ticketing queue. There is no single person to return, so a reverse lookup that promises one is guessing. The company half still resolves perfectly, because the domain is unaffected. The correct move is to keep the company record, leave the person fields empty, and treat the row as a company you now want a named contact at.

This is the gap most of the tools ranking on this query leave open. They report a failed lookup where the honest answer is that the question had no answer. A role address is not a miss, it is a different job.

Free-provider addresses sit outside the business graph

gmail.com, outlook.com, yahoo.fr, orange.fr, laposte.net: a personal mailbox carries no employer, so there is no domain to join a company record against. Accuracy on these addresses is structurally worse than on corporate ones, and any headline coverage figure quoted without that distinction is measuring two different problems at once.

These rows are not lost, they are inverted. Instead of domain first, go person first: search the name against professional profiles, then enrich forward from the profile you find. The find a LinkedIn profile from an email route exists for exactly this shape of row.

Check the address exists first

A readable address can still be dead: the person left, the mailbox was closed, the domain stopped receiving mail. Before you spend a search on an old row from a CRM export, check that the address still works. The guide on how to tell if an email is valid covers the checks, and Email Verification runs them on a whole list in the web app (1 credit per email, paid plans from Standard at 20 EUR per month).

Triage before you spend

1. Split the list on the domain: corporate on one side, free providers on the other.
2. Inside the corporate side, pull the role addresses into their own group.
3. Run the domain-to-company step on both corporate groups. It resolves for all of them.
4. Run the person step only on corporate, non-role rows. That is the only group where it can pay.
5. Send the free-provider rows to a person-first search instead.

On a typical inbound list, that triage removes a fifth to a third of the rows from the paid step without losing a single company record. Measure it on your own file rather than trusting the ratio: the mix depends entirely on where the emails came from.

The 4 methods to find a company from an email in 2026

Each method makes a different trade-off between coverage, accuracy, and cost. Pick based on volume: 1-10 emails/day → free WHOIS or browser tools; 100-1000/month → bulk enrichment in a web app or in Sheets; 10K+/month → paid B2B database with API.

Method 1 - WHOIS + email-domain trick (free, partial)

Strip the domain from the email (everything after the @), then look it up in WHOIS at lookup.icann.org or whois.com. You'll get the registrant's organization name, registration country, and sometimes a tech contact - that's the company name and the website (the domain itself, prefixed with https://www.).

Coverage: ~60% of B2B domains return a usable company name in WHOIS. The other 40% are masked behind registrar privacy services (e.g. "REDACTED FOR PRIVACY") since a 2018 ICANN rule change. Free webmail domains (gmail.com, outlook.com, yahoo.com, hotmail.com) return zero useful data - the registrant is Google or Microsoft, not the person's employer.

Method 2 - Online reverse email lookup tools

Single-search reverse email tools (BeenVerified, Spokeo and similar) take an email and return a contact card: full name, employer, job title, LinkedIn URL, sometimes phone. Pricing typically ranges $0.05 to $0.50 per lookup outside the free tier.

Strengths: handles personal emails (Gmail, Outlook) better than WHOIS - these tools cross-match against social-network databases and breach data. Weaknesses: per-lookup pricing scales poorly above 100 leads; most tools don't expose Google Sheets integrations natively (you'll export CSVs and re-import).

Method 3 - Bulk enrichment with Derrick (web app or Google Sheets)

Derrick is a B2B data enrichment tool used by 34,000+ B2B teams, in its web app or as a Google Sheets sidebar. Load emails into a column, run the reverse lookup, and the next 4-7 columns auto-fill with: company name, official website, LinkedIn company URL, employee count, industry, and (with a different function) the contact's full name, job title, and verified phone.

Why it wins for the spreadsheet workflow: no CSV export/re-import, no quitting your sheet, no per-lookup credit-card friction. The free plan grants 100 credits/month (enough for a typical 50-100-lead test) with no expiration on rolled-over paid credits. Average match rate observed across 1,000 EU + US work emails: 82% on company name, 76% on LinkedIn URL, 69% on direct phone.

Method 4 - Paid B2B databases with batch API

The large B2B databases all offer reverse-email APIs in their paid plans. The trade-off is the same across them: highest accuracy on US enterprise (90%+ match), weakest on European SMB (40-50%). Pricing starts at $5K-$20K/year minimum for batch API access. Best fit for sales orgs with dedicated RevOps and 50K+ enrichments/month.

The pattern in the address is itself a clue about the company behind it. A flast@ address points to a domain that formats like Apple, while first.last@ points to one that formats like SAP. Two domains, two conventions, and the convention narrows the candidates fast.

Step-by-step: find the company by hand (no tools)

Before reaching for software, it helps to know the manual path - it's free, it works for a handful of emails, and it shows you exactly what a tool automates. Here is the full sequence for a single work email.

Step 1 - Extract the domain

Everything after the @ is the domain. From jane.doe@acme.com you get acme.com. That domain is your strongest signal: in most B2B cases it is the company's own website and the root of its brand name.

Step 2 - Open the domain directly

Type https://www.acme.com into a browser. If a real company site loads, the page title, footer, and "About" link usually confirm the legal company name and what they do. If you hit a parking page or a 404, the domain may be an alias or a defunct company - move to Step 5.

Step 3 - Search the domain on LinkedIn

Paste the domain into LinkedIn's search bar. LinkedIn matches company pages to their website domain, so acme.com surfaces the official Acme company page with headcount, industry, and HQ location. This is the fastest way to get the structured firmographics WHOIS won't give you.

Step 4 - Run the email through Google

Search the full email in quotes ("jane.doe@acme.com"). For people who publish their address - founders, recruiters, support leads - this pulls up a personal profile, a press mention, or a directory listing that confirms both the company and the job title.

Step 5 - Check business and WHOIS registries

If the domain is masked or the site is down, fall back to public registries: WHOIS for the domain registrant, plus a national business register (Companies House in the UK, INSEE/SIRENE in France, OpenCorporates worldwide). These confirm the legal entity behind a domain even when the website gives nothing away.

Why the manual method breaks down

Each step takes 30-90 seconds when it works, and it fails silently on personal domains, masked WHOIS records, and stale emails. At 5 emails it's fine. At 200 it's a lost afternoon with an error-prone result. That volume cliff is exactly where automated enrichment earns its place - which is the next section.

When to pick which method

SDRs prospecting from inbound replies

You receive 5-50 inbound emails/week from unknown senders. Speed matters more than batch volume. Run Derrick's Find Names & Domains by Email Addresses on your inbound log, in the web app or from the Derrick sidebar in Google Sheets; the row is enriched before you finish reading the original email.

Recruiters processing applicant lists

You import 200-2000 candidate emails from job-board exports or LinkedIn Sales Navigator. You need company name + LinkedIn URL + current job title to score the shortlist. Derrick batch-enriches in its web app or in the same Sheet as your applicant tracker; no CSV round-trips, no duplicate spreadsheets.

Marketers cleaning a webinar list

Post-event, you have 500-5000 attendee emails. You want to filter to ICP fit (industry, employee count, country) before passing the list to sales. Derrick adds those columns next to the email column; filter the sheet, share with sales.

Common mistakes when finding a company from an email

The lookup itself is simple. The errors that wreck a list come from skipping the checks around it.

• Not validating the email first. Enriching a bad address wastes the lookup and pollutes your list. Verify deliverability before you enrich - a quick pass with a bounce email checker removes dead rows up front.
• Assuming the domain tells the whole story. Holding companies, agencies, and subsidiaries often share one domain across several brands. The domain gives you the entity; firmographics (industry, size) still need a second source.
• Ignoring data freshness. People change jobs every 2-3 years. A company name pulled from a two-year-old record may point to an employer the contact already left. Treat job title and employer as time-sensitive fields.
• Over-trusting automation with zero spot-checks. Even an 82% match rate means roughly 1 in 5 rows needs a human glance. Sample 10-20 enriched rows before you act on the full list.
• Treating enrichment as a one-and-done. Company data decays. For lists you reuse - a CRM, an evergreen webinar funnel - re-enrich on a schedule instead of trusting last quarter's snapshot.

Troubleshooting: when you can't find a company name

The email uses a personal domain (Gmail, Yahoo, Outlook)

The domain is useless here, so the only path is a reverse-enrichment tool that cross-matches the address against social and B2B databases. Match rates drop to ~30-40% on personal domains, so set expectations and keep a manual-research fallback for high-value rows.

The domain was registered very recently

New domains often have empty WHOIS records and no LinkedIn page yet. Wait for indexing, or check the company's funding announcements and press coverage, where early-stage startups surface before their data providers catch up.

It's a freelancer or consultant email

Solo operators frequently use a personal-brand domain or a Gmail address with no company entity behind it. In that case "the company" is the individual - capture the person's name and LinkedIn instead of forcing a corporate match.

The email is stale (the person changed jobs)

A bounced or outdated address often signals a job change. Re-run a real-time email verification to confirm status, then re-find the person at their new company rather than enriching the old domain.

Find the company for 500 form submissions at once

Every free lookup widget on this query is built for one address at a time, and the real job almost never looks like that. A quarter of webinar registrations, a full year of contact-form submissions, a CRM column of unmatched senders: these arrive as files of hundreds or thousands of rows, and a single-address box is the wrong shape for them.

The batch version is the same three steps, applied to a column instead of a field:

1. Load the column. Emails in one column, one row per address, in a sheet or a CSV.
2. Run the deterministic pass first. Names and domains across the whole column, unlimited on every plan. This is also your triage: the rows that come back without a name are your role addresses and pattern-breakers.
3. Run the probabilistic pass on what is left. Company enrichment on the domains, person enrichment on the named rows, and verification on anything you intend to email.

Order matters more than tooling here. Running the paid pass first means paying to discover that a third of the list was contact@. Running the free pass first tells you the same thing at no cost, and shrinks the paid pass to the rows that can actually return something.

Where to run it: the web app, Sheets, Claude (MCP) or the API

Four doors, one dataset. Pick by where the addresses already sit, not by which one sounds most advanced.

• The Google Sheets extension, when the emails are already in a spreadsheet or a CSV export. You add a column, the results fill down, and the file stays the file. This is the right door for a webinar list or a form export.
• The MCP server, when the question arrives inside a conversation. In Claude, Claude Code, ChatGPT or any MCP client, you ask who is behind an address and the answer comes back in the thread. Right door for one-off checks and for an agent doing research on your behalf.
• The REST API, when the lookup has to happen without anybody watching. A form submission gets reversed the second it lands, the CRM record is created enriched, and nobody exports anything. Right door for a workflow or a product feature. Available from the Plus plan.
• The web app, for the same work in a browser without a spreadsheet in the way. Nothing to install.

The four share one dataset and one credit balance, so a lookup run from a sheet and the same lookup run from an API call return the same record. Choosing a door is a question of ergonomics, never of data quality.