How to find a recruiter's email (and what to send)

The fastest way to find a recruiter's email is to work out the company's email pattern from one address you can already see, apply that pattern to the recruiter's name, and verify the result before you send. Most companies use the same format for everyone, so one known address unlocks the whole building.

Worth doing? Yes. Referred and directly-contacted candidates get interviewed and hired at far higher rates than people who apply into the void, which is why so much hiring runs through warm intros instead of the careers page. A real person reading a real email is a different game than your application sitting in a queue of four hundred. This is how you get in front of that person without being a nuisance.

Who to actually contact (not just recruiters)

Recruiters are the obvious target, but they are not the only one, and sometimes not the best one. Two kinds of people can move your application forward:

• The recruiter for that role. Search LinkedIn for "[company] recruiter" or "[company] talent" and look for someone who posts about the team you want. Their whole job is filling reqs, so a sharp email about a role they own lands as help, not interruption.
• Someone already in the role or on the team. Search the job title plus the company. A peer who does the exact work you are applying for can refer you, and their referral often carries more weight internally than an inbound note to a recruiter. Managers count too, but peers are usually easier to reach and quicker to reply.

Pick people close to the actual work. A recruiter three teams over or a VP who has never heard the role's name will not help you, no matter how good your email is. Closeness to the req beats seniority every time.

Find the email: the pattern trick

You rarely find a recruiter's exact address published. What you find is the company's format, and then you build the address yourself. Almost every company uses one consistent pattern across staff. The common ones:

• first.last@company.com (jane.smith@company.com)
• first@company.com (jane@company.com), common at smaller companies
• flast@company.com (jsmith@company.com)
• first_last@company.com (jane_smith@company.com)
• firstlast@company.com (janesmith@company.com)

To find which one a company uses, you need a single known address. Places those hide in plain sight:

• The company site. A press page, a "contact" or PR line, or a support address often shows the format. If press@ is press@acme.com and a named contact is maria.lopez@acme.com, you have your answer.
• Press releases and news posts. These usually list a media contact with a full name and email. That one address gives you the pattern for everyone.
• Public docs and job posts. Some listings include an apply-to or referral address. A GitHub commit, a conference speaker bio, or a support ticket signature can leak one too.

Once you know the format, plug in the recruiter's first and last name and you have a strong candidate address. Do not stop there, though. A good guess is still a guess.

Two edge cases to watch. Big companies sometimes run more than one domain, so a corporate address might be @company.com while the recruiting team uses @talent.company.com or a separate brand domain. And common names collide: if there are two Jane Smiths, the pattern may break to jane.smith2@ or a middle initial. When the obvious guess fails, these are usually why. Do not assume the person changed jobs just because one format did not verify.

Verify it before you hit send

Sending to an address you have not checked is how you bounce, and bounces quietly hurt you. Too many failed sends and your own email starts landing in spam folders, which follows you to every future message. A thirty-second check is worth it.

• Run it through a verification tool. Free and paid email verifiers do a deliverability check without sending anything: they confirm whether the mailbox actually exists. Search "email verifier" and paste your candidate address in. Green means send, red means try the next pattern.
• Check the LinkedIn contact panel. Plenty of people list a personal or work email under "Contact info" on their profile. If it is there, you can skip the guessing entirely. A first-degree connection sees more of this, which is one more reason to connect first.
• Try the pattern, not a shotgun. If a verifier says your first guess is invalid, test the next most common format for that company rather than emailing all five. Guessing five and sending to all of them is exactly the behavior that gets addresses flagged.

When you cannot verify at all, fall back to LinkedIn. A polite connection request with a one-line note is slower than email, but it never bounces and it never hurts your sender reputation.

What to send (short beats long)

You found the person and confirmed the address. Now do not waste it on a wall of text. The message that gets a reply is short, specific, and finished: the recruiter should be able to act without asking you for a single thing. That means three ingredients.

• The job link, pasted in. Do not make them search for which role you mean. Drop the exact posting so they can open it in one click.
• Two lines on why you fit. One concrete result with a number, and one skill or domain match pulled straight from the job description. Not adjectives. Proof.
• Your resume, attached. On email, attach it to the first message so nothing is blocked on a reply. The whole point is that referring you or moving you forward takes two minutes, not a back-and-forth.

The subject line does real work here, so do not waste it on "Hello" or "Job inquiry." Name the role and yourself: "[Role] application: [your name]" or "Quick question about the [Role] opening." A recruiter skimming forty unread messages decides whether to open yours from that line alone, and a specific subject reads as someone who did their homework, not someone running a mail merge.

Keep the whole thing under 120 words, and give them an easy out so declining feels effortless. If you want the exact wording, the referral outreach guide has copy-paste templates for the recruiter email, the peer ask, and the shared-background note. Steal those and change the brackets.

A quick checklist before you send

• Right person? They recruit for or work on the team you are targeting, not three departments away.
• Verified address? You checked the pattern against a verifier or found the email on their profile, so it will not bounce.
• Personalized? The message names the role and one real reason you fit. It could not have been sent to anyone else.
• Everything attached? Job link pasted, resume attached, fit in two lines. Nothing for them to chase.
• One at a time? You are not blasting the same text to ten people at the same company.
• Follow-up plan? One polite nudge after four or five business days, then you let it go.

Do it respectfully or do not do it

Cold outreach done right is a normal, expected part of hiring. Recruiters get these emails all the time and reply to the good ones. Done wrong, it is spam, and spam gets you blocked, reported, and occasionally screenshotted into a group chat you never wanted to be in. The line between the two is simple: personalize every message, never send identical text to a list, and cap yourself at one polite follow-up. If you would be embarrassed to have the recipient see the other nine copies you sent, do not send it.

Doing all of this by hand is slow: hunting LinkedIn, reverse-engineering the pattern, verifying each address, then writing the note. If you would rather skip the grind, EasyCoverLetter pulls verified recruiter and peer emails at the company you are targeting and drafts the outreach for you, so the only thing left is to read it, make it yours, and hit send.

The address is not the hard part once you know the trick. The hard part is sending something worth reading. Get the person right, verify the email, keep it short, and you have done more than the four hundred people who just clicked apply and hoped.