How to find a doctor's email address

No public registry lists doctors' email addresses. The CMS file gives a name, specialty, practice address and phone for each clinician, so an address has to come from the practice's own site, from its mailbox pattern checked with an SMTP test, or from a seller. In our test of 400 cardiologists, 55 (14%) ended with an address that passed.

We sell physician email lists, so we have a stake in the third route below. The test numbers are ours: one run on Sep 10, 2026, one specialty, one verification service. Nothing here is a survey of the industry.

By Ryan Doyle, founder of Doctor Email List. Published Oct 19, 2026.

What the public files give you

The CMS Doctors and Clinicians file, which every list we sell starts from, has one row per clinician by NPI: name, specialty, practice name, street address, phone, medical school and graduation year. It has no email column. The file we used was modified Aug 18, 2026. Everything below is about the step after that file: getting from a practice to a mailbox that exists.

5 ways to get an address

RouteWhat you doWhat it costsWhat we saw
Read the practice websiteOpen the practice site and look for a staff page, a contact form or a printed address.Free, a few minutes for each physician.Printed personal addresses did not help in our run: 0 of the 55 verified addresses came from one.
Work out the address pattern and check itFind the practice domain, find how it names mailboxes (first.last, flast), build the address, then run an SMTP check.A verification fee for each address, plus the time to build the tooling.55 of 400 cardiologists ended with an address that passed (14%). All of them came from this route.
Buy a one-time listDownload a file where the finding and checking is already done.$295 for one specialty here, $995 for all 36; the cost guide shows what other sellers print.Ours builds the email column after you order and prints the check date; most rows have a practice phone, and an address only where one passed.
Use a database with credits or a subscriptionSearch and export contacts inside a platform that verifies at export.$6,999 for 112,656 US contacts, one timeUpLead lists 7-day free trial.
Call the front deskMost rows in the CMS file carry the practice phone number. Ask who handles vendor mail.Free, your time.Works for a short list of named physicians. Does not scale past a few dozen.

What happened to 400 cardiologists

We ran the pattern route on 400 cardiologists on Sep 10, 2026: 200 from the largest group practices and 200 from mid-size and small practices. Each physician ended in exactly one of these places.

OutcomePhysiciansShareWhat it means
Passed an SMTP check5514%An address built from the practice domain's pattern that the mail server confirmed.
Domain accepts every address8822%A catch-all mail server says yes to anything, so a pass proves nothing. We leave these blank.
No practice domain found11228%We could not tie the physician to a website of their own practice.
Domain found, no usable pattern12632%We found the site but could not settle on how the practice names its mailboxes.
Pattern guessed, mailbox not found195%Up to two candidate addresses were checked and neither was confirmed.

Practice size mattered. The largest group practices gave 37 of 200 (19%); mid-size and small practices gave 18 of 200 (9%). The large groups were about twice as likely to yield an address.

Limits of this test

It covers one specialty, one run and one verification service (MillionVerifier), and the shares are rounded. Other specialties will differ. Read 14% as what the pattern-and-check route produced for cardiologists in September 2026, not as an industry rate. When a seller quotes an email accuracy figure, ask how many rows were checked and when.

How to check an address before you send

  1. Confirm the domain belongs to the practice, not to a similarly named business.
  2. Run an SMTP check and keep only the results that come back as ok.
  3. Treat a catch-all domain as unverified. A server that accepts every address cannot confirm yours.
  4. Send a small first batch and read the hard bounces before the rest. Our own refund rule uses the same line: more than five percent of verified emails hard-bouncing on the first send within thirty days (terms).
  5. Put an opt-out in every message and honor it within ten business days. The legal guide has the FTC's wording.

Where our lists fit

We sell the finished version of the second route, one CSV per specialty: see the lists, what a list costs or how the sellers compare. The email column is built after the order and only addresses that passed a check go in.

Sources

Questions people ask

How do I find a doctor's email address?

Start from the practice, not the physician: find the practice website, work out how it names mailboxes, then check the address with an SMTP test. In our test of 400 cardiologists that route produced 55 verified addresses (14%).

Is there a free list of doctors' email addresses?

The CMS Doctors and Clinicians file is free and lists every enrolled clinician by NPI with a practice address and phone. It has no email column, so a free list of addresses does not come from it.

Why can't every doctor's email be verified?

In our test 112 of 400 had no practice domain we could find, 126 had a domain with no usable pattern, and 88 sat on catch-all servers that accept any address, which makes a pass meaningless.

Does the practice size change how many addresses you can find?

In our test it did: 37 of 200 at the largest group practices passed (19%) against 18 of 200 at mid-size and small practices (9%). It was one specialty and one run, so treat it as a lead.

Is it legal to email a doctor you found this way?

In the US, yes, if each message follows CAN-SPAM: accurate headers, a subject line that matches, a clear ad notice, a postal address and an opt-out you honor. The legal guide has the FTC wording and the date we read it.