How to Find Email Addresses with Google Dork Operators

By the getdork team — Published June 12, 2026

Google indexes any email address that appears as plain text in a publicly accessible webpage or document. The intext: operator lets you search for the @domain.com pattern directly; pairing it with site: focuses the search on a specific company's own pages. This technique surfaces publicly posted contact addresses, staff directories, and document-embedded emails — all information the organization chose to make visible on the open web.
On this page

How email discovery with dorks works

When a company publishes an email address in the HTML of a public page — on a contact page, a staff directory, an about page, a published PDF, or a press release — Google crawls and indexes that text. Because the intext: operator searches the indexed page body, a query like: 

site:company.com intext:"@company.com"

returns pages on company.com that contain text matching the @company.com pattern — which is where email addresses live.

This is not a workaround or exploit. It is the same thing as browsing to a company's contact page and reading what is written there — just faster and across multiple pages at once.

Step-by-step: find public emails for a target company

  1. Start with the company's own domain. Use site:company.com intext:"@company.com" to find every indexed page on the domain that contains a company email address.
  2. Target contact and team pages. Contact, staff, and about pages are the highest-yield locations. Add inurl:contact OR inurl:team OR inurl:staff to your query to surface those pages directly.
  3. Check published documents. Annual reports, program guides, and conference materials often list staff emails. Use filetype:pdf intext:"@company.com" to find PDFs that contain the company's email addresses.
  4. Search outside the company's domain. Press releases, government filings, and industry event programs published on third-party sites often include email addresses. Remove site: and search intext:"[email protected]" broadly.
  5. Use role-based patterns as a cross-check. Many companies follow predictable patterns: first.last@, firstlast@, or f.last@. If you find one named email, you can infer the pattern and look for colleagues by name.
  6. Verify before outreach. Addresses found via dork searches may be outdated. Run a quick bounce check or use an email validation service before adding addresses to a campaign.

Query examples

Company contact pages and staff directories

# Find any page on the company domain listing their own emails
site:company.com intext:"@company.com"

# Contact and team pages specifically
site:company.com inurl:contact OR inurl:team intext:"@company.com"

# About or leadership pages
site:company.com inurl:about OR inurl:leadership intext:"@company.com"

PDFs and documents with contact lists

# PDFs on the company domain containing their email addresses
filetype:pdf site:company.com intext:"@company.com"

# Conference or event programs (often list speaker contacts)
filetype:pdf "conference" "2026" intext:"@company.com"

# Government FOIA-released documents often contain agency email addresses
filetype:pdf site:.gov intext:"@agency.gov" "contact"

Mentions across the wider web

# Any page across the web mentioning a company's email addresses
intext:"@targetcompany.com" -site:targetcompany.com

# Trade association or industry body membership directories
intext:"@targetcompany.com" site:industryassociation.org

Limits of this technique

Google will not return emails that are:

For finding emails at scale, dedicated tools (Hunter.io, Apollo, Clay) maintain their own curated databases. Dork searches are best used for targeted research on specific companies or to verify that a found address is genuinely public.

Build these queries faster with getdork.
The query builder handles the operator syntax; you fill in the domain and keywords. Free to generate queries; Pro runs them in-app with results you can export to CSV.

Try getdork free →
Responsible use: public data, real legal obligations

Finding an email address via a dork is the same as reading it off a public webpage — the address was published voluntarily. The legal and ethical obligations come into play the moment you send to that address.

CAN-SPAM (United States)

The CAN-SPAM Act applies to any commercial email sent to US recipients, regardless of the sender's location. Key requirements: use an accurate From/Reply-To, write a non-deceptive subject line, include your physical postal address, provide a clear unsubscribe mechanism, and honor opt-out requests within 10 business days. CAN-SPAM does not prohibit cold B2B email — it governs how it must be sent.

GDPR (EU and UK)

GDPR applies when you email individuals in the EU or UK, including at their work addresses. For B2B outreach, "legitimate interest" is the most-used lawful basis. This requires that your interest in contacting the person is genuine and proportionate, that the contact is relevant to their professional role, and that you provide a clear way to opt out. You must honor opt-outs promptly. Named individual emails ([email protected]) are personal data under GDPR; role-based addresses ([email protected]) occupy a grayer position but are still subject to the law when tied to an identifiable person.

Anti-spam and deliverability

Beyond legal compliance: sending unsolicited mass email to dork-sourced addresses damages deliverability. High bounce rates and spam complaints hurt the sender's domain reputation. Treat found addresses as leads for manual, personalized outreach — not as a list for bulk blasting.

Frequently asked questions

Is it legal to find email addresses using Google dorks?

Yes. Finding publicly listed email addresses via search operators is legal — you are reading information the organization chose to publish on a public webpage. The legal obligations arise when you use those addresses: CAN-SPAM governs commercial email sent to US recipients; GDPR governs outreach to EU/UK individuals. See the Is Google dorking legal? guide for the full legal breakdown.

Why doesn't Google show email addresses in results?

Sites that want to prevent harvesting use JavaScript rendering, image-based display, HTML obfuscation, or plain contact forms instead of posted addresses. If a company actively hides its email addresses from the public web, dork searches will not surface them — and that boundary should be respected.

What is the difference between intext: and site: for finding emails?

site: restricts which domain the results come from. intext: requires the specified text to appear in the page body. For email discovery, use both: site:company.com intext:"@company.com" finds pages on the company's own domain that contain email addresses in their text.

What does CAN-SPAM require for cold outreach?

CAN-SPAM requires: an accurate sender address, a non-deceptive subject line, a physical postal address in the email body, a functional opt-out link, and honoring opt-out requests within 10 business days. It does not prohibit sending unsolicited commercial email to business contacts — it sets the rules for how that email must be structured.

Does GDPR apply to B2B email outreach?

Yes, when you contact individuals in the EU or UK at their work addresses. For B2B prospecting, most organizations rely on the "legitimate interest" lawful basis. This requires genuine relevance to the recipient's professional role and an easy opt-out path. Generic role addresses carry less individual data-protection weight than named addresses, but GDPR still applies when the address identifies a person. When in doubt, consult your legal counsel for your specific situation.

Related guides