B2B Email Finder & Live SMTP/MX Verifier 🎯✉️

Find corporate business email addresses using permutation guessing, DNS MX records, and optional socket-level SMTP handshakes — without ever sending actual emails.

Built for cold email agencies, B2B sales teams (SDRs/BDRs), and lead-generation specialists who need pattern + MX intelligence without a $100+/mo SaaS bill.

Apify Cloud limitation: outbound port 25 is blocked. On Cloud, the default output is name permutations, MX hosts, and mail-provider fingerprinting (UNVERIFIED / RISKY if SMTP cannot complete). Live mailbox RCPT TO checks need verifier_api_url pointing at your own service that can reach port 25 (verifier_api/ in this repo).

---

🌟 Key Features

• 🧠 Corporate Pattern Permutations: Generates standard B2B email permutations from first name, last name, and domain:
  • {first}.{last}@{domain} (Gold standard for Enterprise B2B)
  • {first}{last}@{domain}
  • {first}@{domain}
  • {f}{last}@{domain}
  • {f}.{last}@{domain}
  • {first}_{last}@{domain}
  • {last}.{first}@{domain}
• 🛡️ Intelligent Catch-All Detection: Detects domains configured with catch-all policies that accept every incoming address regardless of existence. Crucial for protecting your domain sender reputation from hidden bounces.
• ⚡ Enterprise Verification Pipeline: 3-stage verification process:
  1. Syntax Validation: RFC 5322 regex conformance.
  2. DNS MX Priority & Provider Fingerprinting: Resolves primary MX hosts and detects whether the infrastructure is Microsoft 365, Google Workspace, Mimecast, Proofpoint, Zoho, Proton, etc.
  3. Live Socket SMTP Handshake: Executes clean RFC EHLO, MAIL FROM:<check@verifier.net>, and RCPT TO:<email> on port 25. Never sends DATA or message body.
• 🔄 Smart Permutation Preservation on Catch-All: When a domain is detected as catch-all, the Actor provides the standard {first}.{last} email along with all generated candidate_patterns so you have complete visibility.
• 📦 Single Prospect or Bulk Lists: Verify single contacts or pass thousands of records in bulk arrays.

---

🛡️ Why Catch-All Detection is Critical for Cold Email

Many corporate mail servers (such as certain Google Workspace configurations or custom relays) return 250 OK for any random recipient address.

If your email verifier blindly stops at the first 250 OK:

• It may falsely mark an arbitrary pattern (like celal@) as valid.
• When you send cold emails, these messages either silently bounce later or trigger soft bounces, severely damaging your sender score and landing future emails in the spam folder.

Our Intelligent Engine:

1. Tests a cryptographically randomized probe address (verify_{uuid}@{domain}).
2. If the server accepts the probe, it flags the domain as Catch-All.
3. It sets the status to RISKY (Catch-All - Mailbox cannot be uniquely distinguished).
4. It sets best_guess_email to the industry standard {first}.{last}@{domain} format and outputs all possible addresses in candidate_patterns.

---

🏢 Enterprise Verification Pipeline Architecture

graph TD
    A[Input: Name & Domain] --> B[Permutation Generator]
    B --> C[DNS MX Resolver & Provider Detection]
    C --> D{MX Records Found?}
    D -- No --> E[Status: MX_NOT_FOUND]
    D -- Yes --> F[Catch-All Probe on Port 25]
    F -- Probe Accepted 250 --> G[Flag: is_catch_all = true]
    F -- Probe Rejected 550 --> H[Flag: is_catch_all = false]
    G --> I[Status: RISKY Catch-All]
    I --> J[Output: best_guess {first}.{last} + candidate_patterns]
    H --> K[Sequential RCPT TO Tests]
    K -- 250 OK Found --> L[Status: VALID Verified Deliverable]
    K -- All 550 Rejected --> M[Status: NO_MATCH_FOUND]

---

📥 Input Parameters

Parameter	Type	Default	Description
first_name	String	""	Prospect first name (e.g. Sam).
last_name	String	""	Prospect last name (e.g. Altman).
domain	String	""	Target company website domain (e.g. openai.com).
bulk_targets	Array<Object>	[]	List of {first_name, last_name, domain} objects for bulk verification.
deep_smtp_check	Boolean	true	Connect to target MX servers to check mailbox existence via RCPT TO.
timeout_seconds	Integer	10	Socket timeout for DNS and SMTP checks in seconds.
verifier_api_url	String	""	Required for live SMTP on Apify Cloud. Point at a host that can reach port 25. Without it the Actor still returns permutations + MX.
verifier_api_key	String	""	API key sent as X-API-KEY to verifier_api_url.

---

📦 Output Dataset Schema Examples

Example 1: Direct Verified Deliverable (VALID)

{
  "full_name": "Satya Nadella",
  "domain": "microsoft.com",
  "best_guess_email": "satya.nadella@microsoft.com",
  "status": "VALID (Verified Deliverable)",
  "mail_provider": "Microsoft 365",
  "is_catch_all": "false",
  "candidate_patterns": "satya.nadella@microsoft.com, satyanadella@microsoft.com, satya@microsoft.com, snadella@microsoft.com, s.nadella@microsoft.com, satya_nadella@microsoft.com, nadella.satya@microsoft.com",
  "tested_patterns": "satya.nadella@microsoft.com: VALID (250: Mailbox exists and accepts messages)",
  "timestamp": "2026-09-14T13:15:00.000Z"
}

Example 2: Catch-All Domain (RISKY)

{
  "full_name": "Sam Altman",
  "domain": "openai.com",
  "best_guess_email": "sam.altman@openai.com",
  "status": "RISKY (Catch-All - Mailbox cannot be uniquely distinguished)",
  "mail_provider": "Google Workspace",
  "is_catch_all": "true",
  "candidate_patterns": "sam.altman@openai.com, samaltman@openai.com, sam@openai.com, saltman@openai.com, s.altman@openai.com, sam_altman@openai.com, altman.sam@openai.com",
  "tested_patterns": "verify_4cc369ade835@openai.com: Catch-All Detected (Random mailbox accepted 250), sam.altman@openai.com: 250 (Accepted by Catch-All MX)",
  "timestamp": "2026-09-14T13:15:05.000Z"
}

---

🚦 Verification Status Reference

• VALID (Verified Deliverable): Confirmed existent via SMTP 250 OK on a domain with non-catch-all verification.
• RISKY (Catch-All - Mailbox cannot be uniquely distinguished): Domain accepts all incoming addresses; recommended {first}.{last} is provided alongside candidate_patterns.
• NO_MATCH_FOUND: All tested corporate permutations returned 550 Mailbox Not Found.
• UNVERIFIED (MX Active - No SMTP Service): Domain has healthy MX records, but SMTP port 25 was restricted (this is the normal Apify Cloud result unless verifier_api_url is set).
• MX_NOT_FOUND: The domain does not have active MX records or does not exist.

---

🧪 Local Testing

Run the Actor locally inside the isolated storage sandbox:

$python test_local.py

---

🚀 Deployment to Apify Cloud

Deploy to Apify platform with a single command:

$python deploy.py --yes