How to Find Any Company CEO, Owner & Leadership Team Contact Details

You found the CEO’s email. You verified it. It even passed the SMTP check. There is one problem: it belongs to the person who held the seat eight months ago, and the executive in it now sits behind a catch-all domain that returned “valid” for every address you tried, including the three you invented. Finding a leader’s contact details is easy. Finding the right one, proving it is real, and being legally allowed to use it is where almost everyone quietly fails.

Most guides on this topic hand you ten email-finder tools and call it a method. That is the volume trap. This is the workflow: five layers, in order, that take you from a name on a website to a verified, compliant, deliverable contact. We call it the CLEAR framework, and the two layers everyone skips are exactly the ones that break CEO and owner data.

Why “owner” and “CEO” are two different searches

The CEO runs the company. The owner controls it. For most private businesses, they are not the same person, and you find them in completely different places. Every competing article on this topic conflates the two, which is why their advice collapses the moment you leave the world of well-known public companies.

A CEO is an operating role. You find CEOs through the channels this guide spends most of its time on: leadership pages, LinkedIn, contact databases. An owner is a legal fact. For a private company or an SMB, the owner, shareholder, or beneficial controller is recorded in a government filing, not in a sales tool. If you need to know who actually controls a business, for due diligence, partnership, KYC, or a high-value deal, no email-finder will tell you. A registry will.

Hold that distinction. It decides which layer you start with.

The CLEAR framework at a glance

Run the layers in sequence and stop as soon as you have what you need. Each layer is cheaper and more reliable than the one below it.

C: Start with what the company publishes about itself

The company has already told you more than you think. Read it before you pay for anything. About, Leadership, and Team pages carry names and titles, and at smaller companies they often carry direct emails. Investor Relations sections carry executive bios, the corporate address, and an IR contact that is frequently a direct line into the executive office.

Two underused moves. First, search “[Company Name] press release” or “[Company Name] funding announcement.” Press releases almost always list a contact at the bottom, usually the CEO’s executive assistant or a communications lead, and that is a legitimate routing path to the top. Second, call the corporate switchboard and ask for the executive office or the public information officer. It works more often than anyone admits.

When you want to sweep the open web, Google search operators do the heavy lifting. Copy these and swap in the domain.

# Any indexed page on the company domain that contains company emails
site:company.com intext:"@company.com"

# Contact, team, about and leadership pages specifically
site:company.com inurl:contact OR inurl:team intext:"@company.com"

# PDFs on the domain (annual reports, decks, filings often list execs)
filetype:pdf site:company.com intext:"@company.com"

# Mentions across the wider web, excluding the company's own site
intext:"@targetcompany.com" -site:targetcompany.com

# Named-person targeting
"Jane Doe" "@company.com"

Practitioners at Prospeo recommend running the broad intext:"@company.com" query first, then the named-person query, and checking only the first two pages of results before moving on. One caution from LetsExtract: press@ and info@ inboxes have legitimate uses, but they are not executive contacts and should never be treated as one.

L: Look up the registry to find the real owner

This is the layer that answers “who owns this company,” and it is almost entirely absent from every other guide. Government registries are free, authoritative, and the only reliable source for owners, directors, and beneficial controllers of private companies.

For US public companies, start at SEC EDGAR (sec.gov/edgar/search). Full-text search covers filings since 2001, and you can search by company or by an individual’s name. The DEF 14A proxy statement lists named executive officers, board members, and compensation, along with the business address and the officer who signed the filing.

For private companies and everyone outside the US, go to the national register. The UK’s Companies House is the model: free, no login, with an Officers tab (names, appointment dates, service addresses) and a PSC tab listing Persons with Significant Control, the closest thing to a beneficial-ownership record. Under the Economic Crime and Corporate Transparency Act 2023, from 18 November 2025 each officer record also shows an identity-verification status, so you can see whether a director has actually confirmed who they are.

OpenCorporates aggregates primary government records and is listed in Bellingcat’s investigation toolkit as a standard OSINT resource. It also publishes an openness score per register, and the gap is instructive: Canada’s federal register scores 80 and Australia’s ASIC 70, while Singapore sits at 40 and India’s MCA at 25. Not every registry publishes officer records equally, so know which one will actually answer your question before you start digging. For startups and venture-backed firms, add Crunchbase, which surfaces leadership, funding history, and contacts on the Organization profile.

E: Enrich with databases and email patterns

This is where you get verified emails and direct dials at scale, and it is where vendor marketing does the most damage to your judgment. Providers advertise 90 to 98 percent accuracy. Independent testing tells a harsher story: most tools deliver roughly 50 percent accuracy on average once you test them on a real sample (Landbase, cited by Salesmotion).

The number that should govern your tool choice is not coverage or accuracy alone, but the tradeoff between them. In one 2026 benchmark, FullEnrich led on coverage at 87.1 percent but carried a 4.0 percent false-positive rate, while Icypeas led on accuracy at 99.1 percent but covered only 49.0 percent of contacts (Enginy). Airscale frames the lesson cleanly: a tool with 90 percent coverage and 70 percent accuracy hands you fewer usable contacts than one with 75 percent coverage and 95 percent accuracy. High coverage on a dirty database is a liability, not an asset. The same test applies whether you are buying a tool, an email appending service, or a full B2B data enrichment run: judge it on usable contacts from a live sample of your accounts, never on raw coverage.

When a tool comes up empty, you can often infer the address, because corporate email follows patterns. Roughly eight formats cover the overwhelming majority of business addresses, and first.last@ alone accounts for close to half at large companies. The dominant format shifts predictably with company size (per Interseller’s analysis of 5M+ companies, treat as directional since the study dates to 2019):

• Under 10 employees: first@ dominates (60 to 70 percent). Startups keep it simple.
• 50 to 1,000 employees: flast@ (jdoe@) becomes the norm.
• 1,000+ employees: first.last@ (jane.doe@) takes over, at 48 to 56 percent.

On LinkedIn, X-ray search (querying Google’s index of public profiles with site:linkedin.com/in "CEO" "Company Name") is the most reliable free move for finding the person. Be precise about the legality: searching Google’s public index is broadly defensible, but it sits in a grey area against LinkedIn’s Terms of Service, and the GDPR obligation attaches to how you store and use what you find, not to the search itself. Present that honestly to yourself before you scale it.

A: Authenticate before you ever hit send

An inferred or purchased address is a hypothesis, not a contact, until it passes a proper email verification process. The verification stack has four steps: a syntax check, a DNS and MX record check (does the domain accept mail at all), an SMTP handshake (does this specific mailbox exist), and a catch-all test.

That last step is where CEO data specifically falls apart. A catch-all domain accepts mail to every address, including deliberately nonsensical ones, so your verifier returns “valid” for a mailbox that does not exist. On catch-all domains, confidence drops from around 95 percent to 50 percent and cannot climb higher no matter what else you know (Apify waterfall-enrichment documentation). Google Workspace and Microsoft 365 domains are commonly configured this way, which means your highest-value executive targets are disproportionately the ones you cannot naively verify. Specialist catch-all resolution (LeadMagic, Findymail) can safely recover 20 to 30 percent of those enterprise contacts, which is often exactly the CEO you were after.

The practical rule: verify at the point of send, not the point of purchase, and re-verify anything older than a quarter. Keep your campaign bounce rate under 2 to 3 percent. Above that you damage your sender reputation, and since February 2024 Gmail and Yahoo will simply start rejecting your mail.

R: Respect the law (or pay per email)

Finding a contact and being allowed to email it are separate questions, and the second one is decided by the recipient’s country, not yours. Build to the strictest standard you target and you are compliant everywhere. Get it wrong and the penalties are per-email, not per-campaign.

CAN-SPAM’s per-email maximum is the FTC’s inflation-adjusted figure (2025 adjustment); the FTC updates it annually, so confirm the current amount at ftc.gov before you publish a hard number. GDPR governs personal data; the ePrivacy Directive governs the message itself, and each EU state implemented it differently, which is why Germany can say no while France says yes.

In GDPR jurisdictions that do permit B2B outreach, the legal basis is legitimate interest (Article 6(1)(f)), and Recital 47 explicitly names direct marketing as a possible legitimate interest. You do not need consent, but you do need a documented Legitimate Interest Assessment: a purpose test (a specific commercial reason this person’s role makes them relevant), a necessity test (email is the least intrusive route and you hold only business data), and a balancing test (would this person reasonably expect the contact). The ICO publishes a free template.

SOLOCAL was fined €900,000 by France’s CNIL in 2025, not for a missing checkbox but because it could not prove why it was emailing those people.

That case reframes the whole exercise. The LIA is not paperwork. It is the evidence that turns a legal position into a defensible one. The mistakes that actually trigger enforcement are mundane: a missing physical postal address, a “Re:” on a first-touch subject line (deceptive under CAN-SPAM), one compliance standard applied across a mixed-geography list, and buying a list you cannot trace. On purchased lists the consensus is blunt: not viable under GDPR or CASL, because you cannot prove consent or lawful origin.

A different job: escalating a complaint to a CEO

If you are a customer trying to reach a CEO to resolve a dispute, not a seller, the method is different and it has a name. The Executive Email Carpet Bomb, popularized by Ron Lieber in the New York Times, is a single well-written message sent to a group of senior executives at once rather than through the support queue.

It works because executive offices route to a dedicated escalation team, not because the CEO reads your email personally. Document the date, time, and representative name for every prior support contact, make the complaint specific rather than generic, and keep it to one clear message. Directories like CEOemail.com exist purely to serve this. One ethical note that applies to sellers too: mass-blasting executives is exactly how legitimate outreach gets reclassified as spam, so use the channel sparingly.

Frequently asked questions

Sources include SEC EDGAR, UK Companies House, OpenCorporates, Enginy and Airscale (enrichment benchmarks), Interseller (email patterns), MarketingSherpa/HubSpot and ZoomInfo (data decay), the FTC and CNIL (compliance), and the New York Times (executive escalation). Regulatory penalty figures adjust over time; confirm current amounts before republishing.