Email outreach to candidates is the most scalable sourcing channel you have, and the only one where you own the list. LinkedIn throttles InMail, X/Twitter DMs get ignored, and phone calls do not scale past a few dozen a day. Email does.

But the whole channel rests on one thing: the address has to be real, current, and the one the candidate actually reads. Get that wrong and you are not running a slow campaign, you are running a campaign that mathematically cannot work. Bounces damage your sending domain, and a damaged domain quietly buries the emails that were deliverable.

This guide covers the part most articles skip: how email finding actually works under the hood, which tool class to use for which kind of address, what the tools genuinely cost, and how to keep your bounce rate low enough that your outreach survives.

1. The two addresses every candidate has, and why the choice decides everything

Before you pick a tool, pick an address type. Almost every mistake in candidate email sourcing traces back to skipping this step, because the two address types come from completely different data sources, carry different risks, and get different reply rates.

A work email (jane.doe@company.com) is easy to find and easy to verify, because it follows a company pattern and sits on a mail server you can interrogate. It is also read on an employer-owned device, monitored in many regulated industries, and read in the exact context where the candidate least wants to think about leaving. Some readers will never reply from it on principle.

A personal email (jane.doe@gmail.com) is the address the candidate actually chose. It gets read in the evening, it survives the job change you are trying to cause, and it is where a career conversation belongs. The problem: there is no pattern to guess. Nobody can derive a Gmail address from a name and an employer. It can only be looked up in a database that has seen it somewhere, which is why the tool class that finds it is a different tool class entirely.

The practical rule: if the role is senior or the switch is sensitive, spend the credits on the personal email. If you are running volume outreach into a defined set of target companies, work emails are cheaper and faster, and you accept the lower reply rate as the cost of scale.

2. How email finding actually works

There are only three mechanisms behind every tool on the market, and knowing which one you are buying explains every result you will get.

Pattern permutation plus SMTP validation. The tool learns a company's email format (first.last@, flast@, first@), generates the candidate's likely address, then opens a conversation with the company's mail server and asks whether that mailbox exists without sending anything. This is cheap, instant, and works only for company domains.

Database lookup. The tool has previously collected contact records and simply returns the stored one. This is the only mechanism that can produce a personal email. It is also the mechanism that decays: people change jobs, and a record collected two years ago is a guess about the present.

Profile enrichment. You start from a LinkedIn or GitHub profile and the tool resolves it to contact details, usually through a Chrome extension while you browse. This is the shape most recruiters actually work in, because you are already looking at the person.

The mechanism that breaks is SMTP validation, and it breaks on catch-all domains. A catch-all mail server accepts mail for every address at the domain, real or invented, so it answers "yes, that mailbox exists" to anything you ask. Verification becomes structurally impossible, and every SMTP-based verifier hits the same ceiling - Allegrow. When a tool marks an address "accept-all", "risky" or "unknown", this is what happened. It is not a bug, and paying a different vendor will not fix it.

3. The tools, with what they actually cost

Price these per useful lookup, not per month. A cheap plan that returns catch-all "unknown" for half your list is more expensive than a pricier plan that returns verified addresses, and every vendor meters differently, so the sticker price tells you very little on its own.

Apollo.io: the default when you want finding and sending in one place

Apollo.io pairs a large B2B contact database with built-in sequencing, which is the reason it belongs in a recruiting stack rather than just a sales one: the address you find is immediately sendable, without a CSV round trip. Its free plan gives 900 credits per seat per year, released monthly. Basic is $49 per seat per month billed annually or $65 month to month, and grants 30,000 credits per seat per year upfront. Professional is $79 per seat per month annually, and Organization is $119 per seat per month annually with a three-seat minimum and 72,000 credits.

Where it wins: volume outreach into known companies, and teams who want one tool. Where it loses: personal emails. It is built for selling to people at work, not for reaching people about leaving work.

Lusha: the LinkedIn-extension option

Lusha works the way most recruiters source: a Chrome extension that reveals contact details on the profile you are already reading. Published pricing is $49.90, $69.90 and $399.90 per user per month, and there is a free tier to test coverage on your own market before you commit. The caveat: it is priced per user, so credits do not pool across a team the way some competitors allow, and a five-recruiter team pays five times over.

Hunter.io: cheapest per lookup, company domains only

Hunter.io is the purest expression of the pattern-plus-SMTP approach, and it is priced in euros, which people routinely misquote. Free gives 50 credits a month. Starter is 49€ a month, or 34€ a month billed yearly (408€ up front), for 2,000 credits a month. Growth is 149€ (104€ yearly) for 10,000, and Scale is 299€ (209€ yearly) for 25,000 - Hunter. Verification is half price: 0.5 credit verifies one email. The limitation is absolute, though: Hunter finds addresses at domains. It will never give you a candidate's Gmail, and it has no phone data.

ContactOut and SignalHire: when you specifically need the personal email

These are the tool class built for the recruiting use case rather than the sales one, and both surface personal Gmail and Outlook addresses next to work ones. If your reply rates on work emails are poor for senior roles, this is the category to test. Both publish plans that shift often enough that you should read the current page rather than trust any blog, including this one. Test them on twenty people you can independently verify before buying a year.

HeroHunt.ai: skipping the lookup step entirely

HeroHunt.ai approaches it from the other end. Instead of finding a candidate and then finding their email, its AI Recruiter sources from over a billion profiles and handles the contact and outreach step on autopilot, so the email lookup stops being a task you manage. It is free to start. Worth naming the trade-off: you are handing over more of the process than a Chrome extension asks you to, which suits teams optimising for volume more than teams who want to hand-craft every touch.

4. Verification and deliverability: the part that actually kills campaigns

Finding the address is the easy half. The hard half is that your sending reputation is a shared, cumulative asset, and a single bad list damages every campaign that follows it for weeks. Verification is not a nice-to-have step at the end. It is the thing protecting the channel.

Hold your bounce rate under 2%. That is the working threshold across the industry, and it is achievable if you verify at send time rather than trusting a "verified" flag from whenever the record was collected. Contact data decays continuously because people change jobs, so an address verified six months ago is a historical claim, not a current one. Re-verify before every send.

Then there is the rule most recruiters do not know applies to them. Google's bulk sender guidelines classify you as a bulk sender if you send 5,000 or more messages a day to personal Gmail accounts, and require user-reported spam rates to stay below 0.3%, with rates above 0.1% already hurting delivery - Gmail Help. The classification is permanent: cutting your volume afterwards does not undo it. Since candidate outreach is aimed squarely at personal Gmail, this is your regime, not somebody else's.

Practically, that means authenticate your domain (SPF, DKIM, DMARC), warm a new sending domain before you use it, keep daily volume per mailbox modest, and treat "accept-all" results as a separate, lower-priority segment rather than mixing them into your main list.

5. The legal step you cannot skip in Europe

If you source a European candidate's email from a database, you collected personal data about someone who never gave it to you, and the GDPR has a specific rule for exactly that situation. Under Article 14, when data is obtained from a source other than the person, you must inform them within one month, and your first outreach email is the natural place to do it: say where you got their details and link your privacy notice.

The lawful basis for recruiter sourcing is normally legitimate interest, which requires a documented Legitimate Interest Assessment, and it is conditional on you actually contacting the person. Sitting on scraped contact data you never use is the version that is hard to defend. The workable discipline is simple: if you are not going to email them within a month, do not pull the record.

6. A workflow that holds up

Put the pieces in this order and the failure modes mostly disappear. First, decide the address type from the seniority and sensitivity of the role, because that decides your tool. Second, look up the address with the tool class that matches: pattern-based for work emails at known companies, database-backed for personal ones. Third, verify at send time, not at collection time. Fourth, segment out the catch-all results instead of pretending they are deliverable. Fifth, include your Article 14 line in the first email.

If you are starting from nothing and want one tool that covers the largest share of this in a single place, Apollo is the pragmatic first move, with the honest expectation set: it is a work-email engine, and you will eventually add a personal-email source next to it for senior roles.

The tools change every year. The constraint does not: you are borrowing a candidate's attention on an address they did not give you, and the discipline of finding the right one, verifying it, and being straight about where you got it is what keeps the channel working.

Written by Yuma Heymans (@yumahey), who built HeroHunt.ai and its AI Recruiter, which sources candidates from 1B+ profiles and handles the find-the-email-and-reach-out step on autopilot for 15,000+ recruiters.

Pricing verified against each vendor's own pricing page in July 2026. Contact-data vendors change plans and credit models frequently, so confirm current figures before you buy.