📧 Bulk Email Verifier & Finder — Mailbox Exists Check + SPF, DKIM, DMARC

⚡ Use this Actor in n8n — no code

Building no-code workflows in n8n? Install our community node and drop this Actor straight onto your canvas:

📦 n8n-nodes-apivault-email-verifier

Setup: in n8n go to Settings → Community Nodes → Install, paste n8n-nodes-apivault-email-verifier and confirm → add the new node to your workflow → paste your Apify API token → fill in the input and run.

Two tools in one. Verify whether an email really exists with a live mailbox check (accepted / rejected / catch-all), or find a person's email from their name + company (domain or company name). Plus syntax, MX/deliverability, free/role/disposable/gibberish flags, typo fixes, sender authentication (SPF, DKIM, DMARC), spam-trap & DNS-blacklist risk, a Gravatar signal and a 0-100 score. No external key is required for the standard workflow. Verification-result events apply to definitive uncached verdicts; startup, domain-auth and resources may still apply to other results.

---

🤖 For AI agents — MCP & Standby (verify on demand)

Run this Actor in Standby mode for a warm HTTP + MCP endpoint, so an agent can verify or find one address per call inside a workflow — no cold start.

• MCP tools: verify_email (→ mailbox exists / catch-all + SPF/DKIM/DMARC + 0-100 score) and find_email (name + company → verified address).
• REST (same endpoint): GET /?email=jeff@example.com or GET /?name=Jeff%20Bezos&domain=amazon.com

Turn on Standby in the Actor's settings to get your endpoint URL.

---

🔎 Email Finder (name + company → verified email)

Provide people and the Actor resolves the company domain (from a domain or a company name), tries the common address patterns (first.last, flast, first, …), and returns the one the mail server accepts — with a confidence score:

{
  "people": [
    { "name": "John Doe", "domain": "acme.com" },
    { "name": "Jane Smith", "company": "Apify" },
    { "firstName": "Bo", "lastName": "Lee", "domain": "bigcorp.com",
      "knownContacts": [{ "email": "al.ray@bigcorp.com", "firstName": "Al", "lastName": "Ray" }] }
  ]
}

Finder output illustration

Output (extra fields like crmId are passed through); illustrative values, not a live verified contact:

{ "fullName": "Jane Smith", "domain": "apify.com", "domainResolvedFrom": "Apify",
  "foundEmail": "jane.smith@apify.com", "pattern": "jane.smith", "confidence": 0.95,
  "mailboxStatus": "accepted", "mailboxExists": true, "status": "found" }

status is found (verified), catch_all_guess (domain accepts all — best guess), or not_found. Billed only for a confirmed found mailbox. Provide knownContacts to auto-detect the company's email pattern.

---

---

✨ What you get per address

Mailbox existence (live check)

• mailboxExists — true (server accepts it), false (server rejects it), or null (couldn't confirm)
• mailboxStatus — accepted / rejected / catch-all / disposable / no-mx / unknown

Validation

• syntaxValid (RFC-aware) + normalizedEmail (Gmail dot/+tag aware)
• hasMx, mxProvider, mxRecords, domainResolves
• freeProvider, roleBased, disposable, gibberish
• suggestedCorrection (e.g. gmial.con → gmail.com)
• status (valid / risky / invalid / unknown) + deliverabilityScore (0-100) + reasons[]

Sender authentication (domain audit)

• spf — domain publishes an SPF record
• dkim — DKIM key found (+ dkimSelector)
• dmarc — DMARC policy present (+ dmarcPolicy: none / quarantine / reject)

Sender reputation & risk

• blacklisted + blacklists[] — domain listed on a DNS blacklist (Spamhaus DBL / SURBL)
• spamTrapRisk — low / medium / high (+ spamTrapReason) — protect your sender reputation
• greylisting-aware: temporary "unknown" verdicts are retried into definitive answers

Identity signal

• hasGravatar — a Gravatar response was found; it does not verify identity or current mailbox use

A final list-quality report record summarises the run: an A–F grade, deliverable %, and the full valid / risky / invalid / catch-all / disposable / role breakdown.

---

📥 Input

Field	Type	Default	Description
emails	array	required*	Email addresses to check (one per line).
records	array	—	Objects with an email field + any extra columns; all columns are passed through to the output (verify CRM/CSV exports).
emailColumn	string	email	Which field in records holds the address.
emailsText	string	—	Paste a list / CSV column; merged + de-duplicated.
checkMx	boolean	true	Look up MX/DNS deliverability.
verifyMailbox	boolean	true	Live mailbox check (does the address exist?). Paced ~1 address/sec; turn off for a fast domain-only pass.
resolveCatchAll	boolean	true	For catch-all domains, probe a fake address to try to confirm the real one.
deepCheck	boolean	true	Audit SPF/DKIM/DMARC + Gravatar. Turn off for a faster, lighter pass.
deduplicate	boolean	true	Provider-aware de-duplication.
onlyValid / onlyDeliverable	boolean	false	Keep only valid / deliverable addresses.
dropDisposable / dropRoleBased	boolean	false	Drop throwaway / group mailboxes.
exportFormat	string	default	default JSON, csv flat columns, or both.

{
  "emails": ["john.doe@acme.com", "info@apify.com", "test@gmial.con"],
  "verifyMailbox": true,
  "deepCheck": true
}

---

📤 Sample output

{
  "email": "john.doe@acme.com",
  "status": "valid",
  "decision": "send",
  "decisionReason": "verified deliverable",
  "deliverabilityScore": 95,
  "mailboxExists": true,
  "mailboxStatus": "accepted",
  "syntaxValid": true,
  "domain": "acme.com",
  "hasMx": true,
  "mxProvider": "Google Workspace",
  "spf": true,
  "dkim": true,
  "dkimSelector": "google",
  "dmarc": true,
  "dmarcPolicy": "reject",
  "hasGravatar": true,
  "freeProvider": false,
  "roleBased": false,
  "disposable": false,
  "reasons": ["mailbox accepted by the mail server (exists)", "domain enforces DMARC (p=reject)"]
}

---

🚦 Routing decisions (branch, don't re-derive)

Every record carries a decision — one scalar your cadence tool, CRM, Zapier, Make or n8n branches on directly, instead of rebuilding routing rules from the raw flags:

decision	Meaning	What to do
send	verification response supports delivery	review for your authorized workflow
send-monitor	deliverable but bouncy (catch-all / role / free)	warmed sender, watch bounces
verify-later	signals inconclusive (greylisting, DNS hiccup)	re-run before sending
replace	won't work, but a corrected address was suggested	re-source the contact
suppress	never send (dead, disposable, blacklisted, spam-trap)	add to suppression list

decisionReason explains the call in plain English.

Pre-send numbers land in the SUMMARY key: estimatedBounceRate, espSafe (a built-in heuristic, not an ESP compliance certification), recommendedSendVolume, and a decisions breakdown. SUPPRESSION.txt is written alongside it — a newline-delimited list of every suppress / replace address, ready to paste straight into your ESP.

---

💡 Use cases

• Catch fake / dead addresses — the live mailbox check flags addresses the server rejects.
• List cleaning before outreach — drop invalid/disposable, keep deliverable.
• Lead quality scoring — mailbox + Gravatar + MX + auth signals rank real, reachable contacts.
• Domain trust / security audit — flag domains with no SPF/DMARC (spoofable, low trust).
• CRM enrichment — attach existence + provider + auth posture to every contact.

🤖 For AI agents (MCP / Standby)

Run the Actor as a low-latency HTTP/MCP server for lead-gen agents (Claude, Cursor, OpenAI). Enable Standby in the Actor settings, then:

• REST: GET /?email=john@acme.com or GET /?name=Jane%20Smith&domain=apify.com
• MCP tools: verify_email and find_email (JSON-RPC over the Standby endpoint)

💸 Don't pay twice

Set cacheDays (e.g. 7) and any address verified within that window is returned instantly from your private cache and is not charged again — ideal for overlapping CRM/CSV lists.

---

⚙️ Notes & limits

• You only pay for definitive results. Three pay-per-event charges: result (one verified email — valid/invalid), found (a confirmed Finder email — only when a mailbox is found), and domain-auth (SPF/DKIM/DMARC audit, once per unique domain). Catch-all, risky, unknown and not-found are free, and cached re-checks (cacheDays) are free too.
• No API key or external account needed — the live mailbox check is built in. Great for cleaning Apollo, ZoomInfo, Clay or CRM exports before outreach.
• The live mailbox check asks the destination mail server whether it accepts the address (accepted / rejected / catch-all). For catch-all domains and a few providers that hide their answer, existence can't be confirmed and is returned as null / catch-all — exactly as every reputable verifier reports it. Speed: checks run in parallel across different domains while each single domain is paced politely; with mailboxConcurrency: 0 (default) the Actor auto-scales workers to the number of domains in your list, so big multi-domain CRM/Apollo/ZoomInfo exports are processed fast (single-domain lists are paced and slower by design).
• DKIM is detected by probing common selectors; a false means no key was found on those selectors, not that DKIM is absent everywhere.

---

---

⚖️ Acceptable use & disclaimer

• What this Actor returns: email addresses, mailbox-existence and deliverability/authentication signals (SPF/DKIM/DMARC). It never returns, guesses, or exposes passwords, account credentials, or mailbox contents, and it does not attempt to log in to any account.
• Intended use: legitimate email-list hygiene and B2B contact verification — cleaning your own lists before outreach, anti-fraud and deliverability checks, and verifying addresses you have a lawful basis to process.
• Your responsibility: you must use the results lawfully and in compliance with applicable regulations (e.g. GDPR, CAN-SPAM, CCPA) and obtain any required consent. Do not use the Actor or its output for spam, harassment, credential attacks, unsolicited bulk mail, scraping for resale, or any unlawful purpose.
• No warranty: the Actor is provided "as is", without warranties of any kind. Verification reflects what mail servers report at the time of the check and may be incomplete (catch-all, greylisting, providers that hide results). The developer accepts no liability for misuse or for decisions made from the results.

This is general information, not legal advice — consult your own counsel for your specific compliance needs.

---

Built and maintained by Apivault — reliable data Actors, fair pricing.

---

⚖️ Legal, Compliance & Acceptable Use

Please read this section carefully. By running this Actor you accept these terms.

Bottom line: this is a neutral, general-purpose software tool. It only retrieves information that is already publicly available. You — the user — decide what to search for and how to use the results, so you alone are responsible and liable for that use. The developer/operator of this Actor merely provides the tool and does not control, endorse, or take responsibility for what you do with it.

1. Public data only. The Actor accesses only publicly available information. It does not log in on your behalf, bypass access controls, or retrieve private, paywalled, or password-protected data.

2. You are the responsible party (data controller). For every run you start, you act as the data controller and are solely responsible for using the output lawfully. This includes having a valid lawful basis (for business/B2B use this is typically legitimate interest), honoring data-subject rights (access, correction, deletion, opt-out), and complying with all applicable laws and regulations — including, where relevant, the GDPR, UK GDPR, CCPA/CPRA, and similar privacy, marketing, and anti-spam laws (e.g. ePrivacy, CAN-SPAM, CASL, TCPA).

3. Not a Consumer Reporting Agency. This Actor and its operator are not a consumer reporting agency (CRA), and the output is not a "consumer report" under the U.S. Fair Credit Reporting Act (FCRA) or similar laws. You must NOT use it, in whole or in part, to decide a person's eligibility for credit, employment, housing/tenancy, insurance, or any other FCRA-regulated purpose.

4. Respect third-party terms. You are responsible for complying with the terms of service of any website or platform whose public data you choose to process, and with any applicable intellectual-property rights.

5. No warranty. The Actor is provided "as is", without warranty of any kind. Public data may be incomplete, outdated, or inaccurate — verify independently before relying on it. Availability of sources and fields can change at any time.

6. Prohibited use. Do not use this Actor or its output for stalking, harassment, discrimination, fraud, spam, or any unlawful or harmful purpose.

7. Indemnification. You assume all risk and liability arising from your use of this Actor, and you agree to defend, indemnify and hold the operator harmless from any and all claims, losses, fines, or liabilities — including reasonable legal fees — resulting from your use or misuse of the Actor or its output, or from your breach of these terms or of any law.

This section is general information, not legal advice. If you are unsure whether your intended use is permitted, consult your own legal counsel before running this Actor.

Choose an email-list hygiene workflow

Use this email verifier for a list you are authorized to process, and choose the checks needed for that list. Syntax, DNS, sender authentication and mailbox acceptance answer different questions. A domain with MX records does not prove that one recipient exists; a server acceptance response does not guarantee inbox placement or consent to contact the recipient.

Goal	Useful input	Interpretation
Syntax and domain review	emails, mailbox check disabled	Format/DNS context without a recipient-existence claim
CRM list preparation	records and emailColumn	Original business columns can be passed through
Sender-auth research	deepCheck	SPF/DMARC and sampled DKIM selectors, not an inbox-delivery guarantee
Contact discovery	people with domain/company context	Confirmed found versus catch-all guess/not-found

Start with syntax and domain checks

{
  "emails": [
    "not-an-email",
    "info@apify.com"
  ],
  "verifyMailbox": false,
  "deepCheck": false,
  "autoCorrect": false,
  "cacheDays": 0,
  "greylistRetries": 0
}

The invalid string is an intentional quality-control example. With mailbox checking disabled, do not describe the other address as a confirmed live recipient; inspect MX and status evidence separately.

Preserve a CRM row identifier

{
  "records": [
    {
      "crmId": "example-row-1",
      "contactEmail": "qa@example.com"
    }
  ],
  "emailColumn": "contactEmail",
  "verifyMailbox": false,
  "deepCheck": false,
  "exportFormat": "both"
}

This reserved example address illustrates mapping, not a real contact. Keep original row identity with normalized output and review the returned verdict before an automated handoff.

Request domain authentication context

{
  "emails": [
    "info@apify.com"
  ],
  "verifyMailbox": false,
  "deepCheck": true,
  "autoCorrect": false,
  "cacheDays": 0
}

Deep checks can add a separate domain-auth event even when a mailbox-result event is absent. DKIM false means no key was found at the tried selectors; it does not prove that no DKIM key exists anywhere.

Configure a small live-check request explicitly

{
  "emails": [
    "qa@example.com"
  ],
  "verifyMailbox": true,
  "resolveCatchAll": false,
  "greylistRetries": 0,
  "autoCorrect": false,
  "deepCheck": false,
  "cacheDays": 0
}

Replace the reserved example with an address you are authorized to verify. A blocked or inconclusive backend returns unknown; do not rotate configuration or repeatedly run a known source denial as if it were an empty list.

Billing, cached observations and routing limits

There are three chargeable result categories plus startup/resources. Verification result events apply to uncached valid/invalid verdicts; found applies to a confirmed Finder mailbox; domain-auth applies once per actually audited unique domain. A free risky/unknown result is not a promise of a zero-cost run. The Dataset also contains a free _summary record, and some address rows can be unbilled, so raw Dataset length does not equal paid events.

Event, per1,000	Free	Bronze	Silver	Gold	Platinum/Diamond
result	$1.20	$1.00	$0.80	$0.60	$0.40
found	$10	$8	$6	$5	$5
domain-auth	$2	$1.50	$1	$0.80	$0.80

Startup is $0.002 per allocated GB, minimum one event; platform usage is additional. For example, two Free verification events are $0.0024 before startup, resources and any domain-auth work. Review the effective Pricing tab and settled event categories, not just a 'free unknown' label.

cacheDays can reuse prior private-account observations without fresh result charges. That is cached evidence, not a new mailbox check. A syntactically valid address can still fail deliverability. In the current runtime, onlyValid filters by syntaxValid; onlyDeliverable keeps valid/risky syntactically valid rows. Those names should not be interpreted as a guarantee of delivery.

Routing decisions, safeToSend, list grades, estimatedBounceRate and espSafe are heuristics derived from returned flags. They are not measured future bounce rates, an ESP policy certification or permission to send a campaign. Unknown signals stay unknown; Gravatar, role/disposable and blacklist flags can help review but do not verify a person's identity or consent. Read SUMMARY and the suppression output with the individual rows. Store input contacts and credentials privately; addresses are present in run storage even when processing is in memory.

Does accepted guarantee a delivered email? No. It reflects a mailbox-check response at that time and does not guarantee message acceptance, delivery or inbox placement for a later send.

Does Finder return a confirmed address for every person? No. A guessed catch-all candidate and not_found are different from a confirmed found mailbox. This README's small DNS QA does not claim to have tested every Finder/Standby path.

n8n and developer integrations

Use this Actor in your automation or application with the existing community integrations below. An Apify account and API token are required; Actor and platform charges follow the current pricing.

• n8n community node: n8n-nodes-apivault-email-intel. Install package name n8n-nodes-apivault-email-intel in a self-hosted n8n instance that permits community packages.
• n8n community node: n8n-nodes-apivault-email-verifier. Install package name n8n-nodes-apivault-email-verifier in a self-hosted n8n instance that permits community packages.
• Python client and examples: GitHub.
• n8n source and usage: GitHub.
• n8n source and usage: GitHub.

These are community packages. Publication on npm does not establish n8n verification or availability in n8n Cloud. Review the linked package README for supported inputs and setup.