📧 Bulk Email Verifier & Finder — Mailbox Exists Check + SPF, DKIM, DMARC

⚡ Use this Actor in n8n — no code

Building no-code workflows in n8n? Install our official community node and drop this Actor straight onto your canvas:

📦 n8n-nodes-apivault-email-verifier

Setup (30 seconds): in n8n go to Settings → Community Nodes → Install, paste n8n-nodes-apivault-email-verifier and confirm → add the new node to your workflow → paste your Apify API token → fill in the input and run.

Two tools in one. Verify whether an email really exists with a live mailbox check (accepted / rejected / catch-all), or find a person's email from their name + company (domain or company name). Plus syntax, MX/deliverability, free/role/disposable/gibberish flags, typo fixes, sender authentication (SPF, DKIM, DMARC), spam-trap & DNS-blacklist risk, a Gravatar signal and a 0-100 score. No login, no API keys, no proxy. You only pay for definitive results — catch-all and unknown are free.

---

🤖 For AI agents — MCP & Standby (verify on demand)

Run this Actor in Standby mode for a warm HTTP + MCP endpoint, so an agent can verify or find one address per call inside a workflow — no cold start.

• MCP tools: verify_email (→ mailbox exists / catch-all + SPF/DKIM/DMARC + 0-100 score) and find_email (name + company → verified address).
• REST (same endpoint): GET /?email=jeff@example.com or GET /?name=Jeff%20Bezos&domain=amazon.com

Turn on Standby in the Actor's settings to get your endpoint URL.

---

🔎 Email Finder (name + company → verified email)

Provide people and the Actor resolves the company domain (from a domain or a company name), tries the common address patterns (first.last, flast, first, …), and returns the one the mail server accepts — with a confidence score:

{
  "people": [
    { "name": "John Doe", "domain": "acme.com" },
    { "name": "Jane Smith", "company": "Apify" },
    { "firstName": "Bo", "lastName": "Lee", "domain": "bigcorp.com",
      "knownContacts": [{ "email": "al.ray@bigcorp.com", "firstName": "Al", "lastName": "Ray" }] }
  ]
}

Output (extra fields like crmId are passed through):

{ "fullName": "Jane Smith", "domain": "apify.com", "domainResolvedFrom": "Apify",
  "foundEmail": "jane.smith@apify.com", "pattern": "jane.smith", "confidence": 0.95,
  "mailboxStatus": "accepted", "mailboxExists": true, "status": "found" }

status is found (verified), catch_all_guess (domain accepts all — best guess), or not_found. Billed only for a confirmed found mailbox. Provide knownContacts to auto-detect the company's email pattern.

---

---

✨ What you get per address

Mailbox existence (live check)

• mailboxExists — true (server accepts it), false (server rejects it), or null (couldn't confirm)
• mailboxStatus — accepted / rejected / catch-all / disposable / no-mx / unknown

Validation

• syntaxValid (RFC-aware) + normalizedEmail (Gmail dot/+tag aware)
• hasMx, mxProvider, mxRecords, domainResolves
• freeProvider, roleBased, disposable, gibberish
• suggestedCorrection (e.g. gmial.con → gmail.com)
• status (valid / risky / invalid / unknown) + deliverabilityScore (0-100) + reasons[]

Sender authentication (domain audit)

• spf — domain publishes an SPF record
• dkim — DKIM key found (+ dkimSelector)
• dmarc — DMARC policy present (+ dmarcPolicy: none / quarantine / reject)

Sender reputation & risk

• blacklisted + blacklists[] — domain listed on a DNS blacklist (Spamhaus DBL / SURBL)
• spamTrapRisk — low / medium / high (+ spamTrapReason) — protect your sender reputation
• greylisting-aware: temporary "unknown" verdicts are retried into definitive answers

Identity signal

• hasGravatar — the address has a public Gravatar (likely a real, used inbox)

A final list-quality report record summarises the run: an A–F grade, deliverable %, and the full valid / risky / invalid / catch-all / disposable / role breakdown.

---

📥 Input

Field	Type	Default	Description
emails	array	required*	Email addresses to check (one per line).
records	array	—	Objects with an email field + any extra columns; all columns are passed through to the output (verify CRM/CSV exports).
emailColumn	string	email	Which field in records holds the address.
emailsText	string	—	Paste a list / CSV column; merged + de-duplicated.
checkMx	boolean	true	Look up MX/DNS deliverability.
verifyMailbox	boolean	true	Live mailbox check (does the address exist?). Paced ~1 address/sec; turn off for a fast domain-only pass.
resolveCatchAll	boolean	true	For catch-all domains, probe a fake address to try to confirm the real one.
deepCheck	boolean	true	Audit SPF/DKIM/DMARC + Gravatar. Turn off for a faster, lighter pass.
deduplicate	boolean	true	Provider-aware de-duplication.
onlyValid / onlyDeliverable	boolean	false	Keep only valid / deliverable addresses.
dropDisposable / dropRoleBased	boolean	false	Drop throwaway / group mailboxes.
exportFormat	string	default	default JSON, csv flat columns, or both.

{
  "emails": ["john.doe@acme.com", "info@apify.com", "test@gmial.con"],
  "verifyMailbox": true,
  "deepCheck": true
}

---

📤 Sample output

{
  "email": "john.doe@acme.com",
  "status": "valid",
  "decision": "send",
  "decisionReason": "verified deliverable",
  "deliverabilityScore": 95,
  "mailboxExists": true,
  "mailboxStatus": "accepted",
  "syntaxValid": true,
  "domain": "acme.com",
  "hasMx": true,
  "mxProvider": "Google Workspace",
  "spf": true,
  "dkim": true,
  "dkimSelector": "google",
  "dmarc": true,
  "dmarcPolicy": "reject",
  "hasGravatar": true,
  "freeProvider": false,
  "roleBased": false,
  "disposable": false,
  "reasons": ["mailbox accepted by the mail server (exists)", "domain enforces DMARC (p=reject)"]
}

---

🚦 Routing decisions (branch, don't re-derive)

Every record carries a decision — one scalar your cadence tool, CRM, Zapier, Make or n8n branches on directly, instead of rebuilding routing rules from the raw flags:

decision	Meaning	What to do
send	verified deliverable	normal cadence
send-monitor	deliverable but bouncy (catch-all / role / free)	warmed sender, watch bounces
verify-later	signals inconclusive (greylisting, DNS hiccup)	re-run before sending
replace	won't work, but a corrected address was suggested	re-source the contact
suppress	never send (dead, disposable, blacklisted, spam-trap)	add to suppression list

decisionReason explains the call in plain English.

Pre-send numbers land in the SUMMARY key: estimatedBounceRate, espSafe (are you under the 2% threshold ESPs enforce?), recommendedSendVolume, and a decisions breakdown. SUPPRESSION.txt is written alongside it — a newline-delimited list of every suppress / replace address, ready to paste straight into your ESP.

---

💡 Use cases

• Catch fake / dead addresses — the live mailbox check flags addresses the server rejects.
• List cleaning before outreach — drop invalid/disposable, keep deliverable.
• Lead quality scoring — mailbox + Gravatar + MX + auth signals rank real, reachable contacts.
• Domain trust / security audit — flag domains with no SPF/DMARC (spoofable, low trust).
• CRM enrichment — attach existence + provider + auth posture to every contact.

🤖 For AI agents (MCP / Standby)

Run the Actor as a low-latency HTTP/MCP server for lead-gen agents (Claude, Cursor, OpenAI). Enable Standby in the Actor settings, then:

• REST: GET /?email=john@acme.com or GET /?name=Jane%20Smith&domain=apify.com
• MCP tools: verify_email and find_email (JSON-RPC over the Standby endpoint)

💸 Don't pay twice

Set cacheDays (e.g. 7) and any address verified within that window is returned instantly from your private cache and is not charged again — ideal for overlapping CRM/CSV lists.

---

⚙️ Notes & limits

• You only pay for definitive results. Three pay-per-event charges: result (one verified email — valid/invalid), found (a confirmed Finder email — only when a mailbox is found), and domain-auth (SPF/DKIM/DMARC audit, once per unique domain). Catch-all, risky, unknown and not-found are free, and cached re-checks (cacheDays) are free too.
• No API key or external account needed — the live mailbox check is built in. Great for cleaning Apollo, ZoomInfo, Clay or CRM exports before outreach.
• The live mailbox check asks the destination mail server whether it accepts the address (accepted / rejected / catch-all). For catch-all domains and a few providers that hide their answer, existence can't be confirmed and is returned as null / catch-all — exactly as every reputable verifier reports it. Speed: checks run in parallel across different domains while each single domain is paced politely; with mailboxConcurrency: 0 (default) the Actor auto-scales workers to the number of domains in your list, so big multi-domain CRM/Apollo/ZoomInfo exports are processed fast (single-domain lists are paced and slower by design).
• DKIM is detected by probing common selectors; a false means no key was found on those selectors, not that DKIM is absent everywhere.

---

---

⚖️ Acceptable use & disclaimer

• What this Actor returns: email addresses, mailbox-existence and deliverability/authentication signals (SPF/DKIM/DMARC). It never returns, guesses, or exposes passwords, account credentials, or mailbox contents, and it does not attempt to log in to any account.
• Intended use: legitimate email-list hygiene and B2B contact verification — cleaning your own lists before outreach, anti-fraud and deliverability checks, and verifying addresses you have a lawful basis to process.
• Your responsibility: you must use the results lawfully and in compliance with applicable regulations (e.g. GDPR, CAN-SPAM, CCPA) and obtain any required consent. Do not use the Actor or its output for spam, harassment, credential attacks, unsolicited bulk mail, scraping for resale, or any unlawful purpose.
• No warranty: the Actor is provided "as is", without warranties of any kind. Verification reflects what mail servers report at the time of the check and may be incomplete (catch-all, greylisting, providers that hide results). The developer accepts no liability for misuse or for decisions made from the results.

This is general information, not legal advice — consult your own counsel for your specific compliance needs.

---

Built and maintained by Apivault — reliable data Actors, fair pricing.

---

⚖️ Legal, Compliance & Acceptable Use

Please read this section carefully. By running this Actor you accept these terms.

Bottom line: this is a neutral, general-purpose software tool. It only retrieves information that is already publicly available. You — the user — decide what to search for and how to use the results, so you alone are responsible and liable for that use. The developer/operator of this Actor merely provides the tool and does not control, endorse, or take responsibility for what you do with it.

1. Public data only. The Actor accesses only publicly available information. It does not log in on your behalf, bypass access controls, or retrieve private, paywalled, or password-protected data.

2. You are the responsible party (data controller). For every run you start, you act as the data controller and are solely responsible for using the output lawfully. This includes having a valid lawful basis (for business/B2B use this is typically legitimate interest), honoring data-subject rights (access, correction, deletion, opt-out), and complying with all applicable laws and regulations — including, where relevant, the GDPR, UK GDPR, CCPA/CPRA, and similar privacy, marketing, and anti-spam laws (e.g. ePrivacy, CAN-SPAM, CASL, TCPA).

3. Not a Consumer Reporting Agency. This Actor and its operator are not a consumer reporting agency (CRA), and the output is not a "consumer report" under the U.S. Fair Credit Reporting Act (FCRA) or similar laws. You must NOT use it, in whole or in part, to decide a person's eligibility for credit, employment, housing/tenancy, insurance, or any other FCRA-regulated purpose.

4. Respect third-party terms. You are responsible for complying with the terms of service of any website or platform whose public data you choose to process, and with any applicable intellectual-property rights.

5. No warranty. The Actor is provided "as is", without warranty of any kind. Public data may be incomplete, outdated, or inaccurate — verify independently before relying on it. Availability of sources and fields can change at any time.

6. Prohibited use. Do not use this Actor or its output for stalking, harassment, discrimination, fraud, spam, or any unlawful or harmful purpose.

7. Indemnification. You assume all risk and liability arising from your use of this Actor, and you agree to defend, indemnify and hold the operator harmless from any and all claims, losses, fines, or liabilities — including reasonable legal fees — resulting from your use or misuse of the Actor or its output, or from your breach of these terms or of any law.

This section is general information, not legal advice. If you are unsure whether your intended use is permitted, consult your own legal counsel before running this Actor.