How to find a recruiter's email address (without guessing)

Applying through a careers portal means your application joins a queue that a human may never open. Writing to the person who owns the role skips the queue entirely. The hard part is the address, so here is every reliable way to get one, roughly in order of how long it takes.

1. The job posting itself

Start here, because it is free and people skip it. A surprising number of postings — especially from companies under about two hundred people — name the hiring manager in the description, or sign off with a recruiter's name, or include a "questions? write to…" line near the bottom. Read the whole posting before you go looking anywhere else.

2. The company's own domain pattern

Most companies use one email format for everyone. If you can find a single confirmed address at a company — from a press release, a support reply, a conference page, a GitHub commit — you can usually derive the rest.

• first.last@ — the most common by a wide margin at companies over a few hundred people.
• first@ — typical at startups, and often still works at larger companies as an alias.
• flast@ or f.last@ — common in older enterprises and in finance.
• firstl@ — less common, but worth trying third.

This is a guess, and it should be labelled as one in your own head. A guessed address that bounces costs you nothing but a bounce; a guessed address that silently goes to a catch-all costs you a week of thinking you are waiting on a reply.

3. Shared hiring inboxes

careers@, jobs@, hr@, recruiting@, talent@ — these are real, they are monitored, and they are dramatically better than a portal. They are not as good as a named person, because nobody feels personally responsible for a shared inbox. Use one when you cannot find a name, and still write it as though one person will read it, because one person will.

4. LinkedIn, sideways

LinkedIn will not show you an email address, but it will tell you who the recruiter is, which is the harder half of the problem. Search the company plus "recruiter", "talent", or "people ops", find the person whose remit covers your function, and take the name to step 2. A connection request with a note is a reasonable parallel move, but it is slower and easier to ignore than an email.

5. A contact lookup tool

Tools that maintain a database of business contacts will do steps 2 through 4 in one request, and — this is the part that matters — tell you how confident they are. A verified address has been checked against the mail server. A role address is a real shared inbox. A pattern match is an educated guess. Those three things deserve very different levels of confidence from you, and any tool that presents them identically is hiding the thing you needed to know.

Replyrate's HR finder does exactly this — type a company name, get the HR and recruiting contacts with a confidence label on each, and open a prefilled email to one. It is free to try, and the free plan includes a handful of lookups every week.

What to do once you have it

Do not send the same message you would have pasted into the portal. An email to a named person that reads like a form submission is worse than the form submission, because now they know you had their address and still could not be bothered. What to actually write is its own subject.