📧 Bulk Email Verifier & Finder — Mailbox Exists Check + SPF, DKIM, DMARC

⚡ Use this Actor in n8n — no code

Building no-code workflows in n8n? Install our official community node and drop this Actor straight onto your canvas:

📦 n8n-nodes-apivault-email-verifier

Setup (30 seconds): in n8n go to Settings → Community Nodes → Install, paste n8n-nodes-apivault-email-verifier and confirm → add the new node to your workflow → paste your Apify API token → fill in the input and run.

Two tools in one. Verify whether an email really exists with a live mailbox check (accepted / rejected / catch-all), or find a person's email from their name + company (domain or company name). Plus syntax, MX/deliverability, free/role/disposable/gibberish flags, typo fixes, sender authentication (SPF, DKIM, DMARC), spam-trap & DNS-blacklist risk, a Gravatar signal and a 0-100 score. No login, no API keys, no proxy. You only pay for definitive results — catch-all and unknown are free.

---

🤖 For AI agents — MCP & Standby (verify on demand)

Run this Actor in Standby mode for a warm HTTP + MCP endpoint, so an agent can verify or find one address per call inside a workflow — no cold start.

• MCP tools: verify_email (→ mailbox exists / catch-all + SPF/DKIM/DMARC + 0-100 score) and find_email (name + company → verified address).
• REST (same endpoint): GET /?email=jeff@example.com or GET /?name=Jeff%20Bezos&domain=amazon.com

Turn on Standby in the Actor's settings to get your endpoint URL.

---

🔎 Email Finder (name + company → verified email)

Provide people and the Actor resolves the company domain (from a domain or a company name), tries the common address patterns (first.last, flast, first, …), and returns the one the mail server accepts — with a confidence score:

{
  "people": [
    { "name": "John Doe", "domain": "acme.com" },
    { "name": "Jane Smith", "company": "Apify" },
    { "firstName": "Bo", "lastName": "Lee", "domain": "bigcorp.com",
      "knownContacts": [{ "email": "al.ray@bigcorp.com", "firstName": "Al", "lastName": "Ray" }] }
  ]
}

Output (extra fields like crmId are passed through):

{ "fullName": "Jane Smith", "domain": "apify.com", "domainResolvedFrom": "Apify",
  "foundEmail": "jane.smith@apify.com", "pattern": "jane.smith", "confidence": 0.95,
  "mailboxStatus": "accepted", "mailboxExists": true, "status": "found" }

status is found (verified), catch_all_guess (domain accepts all — best guess), or not_found. Billed only for a confirmed found mailbox. Provide knownContacts to auto-detect the company's email pattern.

---

---

✨ What you get per address

Mailbox existence (live check)

• mailboxExists — true (server accepts it), false (server rejects it), or null (couldn't confirm)
• mailboxStatus — accepted / rejected / catch-all / disposable / no-mx / unknown

Validation

• syntaxValid (RFC-aware) + normalizedEmail (Gmail dot/+tag aware)
• hasMx, mxProvider, mxRecords, domainResolves
• freeProvider, roleBased, disposable, gibberish
• suggestedCorrection (e.g. gmial.con → gmail.com)
• status (valid / risky / invalid / unknown) + deliverabilityScore (0-100) + reasons[]

Sender authentication (domain audit)

• spf — domain publishes an SPF record
• dkim — DKIM key found (+ dkimSelector)
• dmarc — DMARC policy present (+ dmarcPolicy: none / quarantine / reject)

Sender reputation & risk

• blacklisted + blacklists[] — domain listed on a DNS blacklist (Spamhaus DBL / SURBL)
• spamTrapRisk — low / medium / high (+ spamTrapReason) — protect your sender reputation
• greylisting-aware: temporary "unknown" verdicts are retried into definitive answers

Identity signal

• hasGravatar — the address has a public Gravatar (likely a real, used inbox)

A final list-quality report record summarises the run: an A–F grade, deliverable %, and the full valid / risky / invalid / catch-all / disposable / role breakdown.

---

📥 Input

Field	Type	Default	Description
emails	array	required*	Email addresses to check (one per line).
records	array	—	Objects with an email field + any extra columns; all columns are passed through to the output (verify CRM/CSV exports).
emailColumn	string	email	Which field in records holds the address.
emailsText	string	—	Paste a list / CSV column; merged + de-duplicated.
checkMx	boolean	true	Look up MX/DNS deliverability.
verifyMailbox	boolean	true	Live mailbox check (does the address exist?). Paced ~1 address/sec; turn off for a fast domain-only pass.
resolveCatchAll	boolean	true	For catch-all domains, probe a fake address to try to confirm the real one.
deepCheck	boolean	true	Audit SPF/DKIM/DMARC + Gravatar. Turn off for a faster, lighter pass.
deduplicate	boolean	true	Provider-aware de-duplication.
onlyValid / onlyDeliverable	boolean	false	Keep only valid / deliverable addresses.
dropDisposable / dropRoleBased	boolean	false	Drop throwaway / group mailboxes.
exportFormat	string	default	default JSON, csv flat columns, or both.

{
  "emails": ["john.doe@acme.com", "info@apify.com", "test@gmial.con"],
  "verifyMailbox": true,
  "deepCheck": true
}

---

📤 Sample output

{
  "email": "john.doe@acme.com",
  "status": "valid",
  "deliverabilityScore": 95,
  "mailboxExists": true,
  "mailboxStatus": "accepted",
  "syntaxValid": true,
  "domain": "acme.com",
  "hasMx": true,
  "mxProvider": "Google Workspace",
  "spf": true,
  "dkim": true,
  "dkimSelector": "google",
  "dmarc": true,
  "dmarcPolicy": "reject",
  "hasGravatar": true,
  "freeProvider": false,
  "roleBased": false,
  "disposable": false,
  "reasons": ["mailbox accepted by the mail server (exists)", "domain enforces DMARC (p=reject)"]
}

---

💡 Use cases

• Catch fake / dead addresses — the live mailbox check flags addresses the server rejects.
• List cleaning before outreach — drop invalid/disposable, keep deliverable.
• Lead quality scoring — mailbox + Gravatar + MX + auth signals rank real, reachable contacts.
• Domain trust / security audit — flag domains with no SPF/DMARC (spoofable, low trust).
• CRM enrichment — attach existence + provider + auth posture to every contact.

🤖 For AI agents (MCP / Standby)

Run the Actor as a low-latency HTTP/MCP server for lead-gen agents (Claude, Cursor, OpenAI). Enable Standby in the Actor settings, then:

• REST: GET /?email=john@acme.com or GET /?name=Jane%20Smith&domain=apify.com
• MCP tools: verify_email and find_email (JSON-RPC over the Standby endpoint)

💸 Don't pay twice

Set cacheDays (e.g. 7) and any address verified within that window is returned instantly from your private cache and is not charged again — ideal for overlapping CRM/CSV lists.

---

⚙️ Notes & limits

• You only pay for definitive results. Three pay-per-event charges: result (one verified email — valid/invalid), found (a confirmed Finder email — only when a mailbox is found), and domain-auth (SPF/DKIM/DMARC audit, once per unique domain). Catch-all, risky, unknown and not-found are free, and cached re-checks (cacheDays) are free too.
• No API key or external account needed — the live mailbox check is built in. Great for cleaning Apollo, ZoomInfo, Clay or CRM exports before outreach.
• The live mailbox check asks the destination mail server whether it accepts the address (accepted / rejected / catch-all). For catch-all domains and a few providers that hide their answer, existence can't be confirmed and is returned as null / catch-all — exactly as every reputable verifier reports it. Speed: checks run in parallel across different domains while each single domain is paced politely; with mailboxConcurrency: 0 (default) the Actor auto-scales workers to the number of domains in your list, so big multi-domain CRM/Apollo/ZoomInfo exports are processed fast (single-domain lists are paced and slower by design).
• DKIM is detected by probing common selectors; a false means no key was found on those selectors, not that DKIM is absent everywhere.

---

---

⚖️ Acceptable use & disclaimer

• What this Actor returns: email addresses, mailbox-existence and deliverability/authentication signals (SPF/DKIM/DMARC). It never returns, guesses, or exposes passwords, account credentials, or mailbox contents, and it does not attempt to log in to any account.
• Intended use: legitimate email-list hygiene and B2B contact verification — cleaning your own lists before outreach, anti-fraud and deliverability checks, and verifying addresses you have a lawful basis to process.
• Your responsibility: you must use the results lawfully and in compliance with applicable regulations (e.g. GDPR, CAN-SPAM, CCPA) and obtain any required consent. Do not use the Actor or its output for spam, harassment, credential attacks, unsolicited bulk mail, scraping for resale, or any unlawful purpose.
• No warranty: the Actor is provided "as is", without warranties of any kind. Verification reflects what mail servers report at the time of the check and may be incomplete (catch-all, greylisting, providers that hide results). The developer accepts no liability for misuse or for decisions made from the results.

This is general information, not legal advice — consult your own counsel for your specific compliance needs.

---

Built and maintained by Apivault — reliable data Actors, fair pricing.