Email finder tools: how they work and what accuracy to expect

An email finder takes a name and a company, looks up the address in a database or builds likely patterns, and checks them against the mail server. The weak spot is the catch all domain, which accepts every address, so no tool can verify those. Vendors quote accuracy figures of their own, such as over 90%. Treat them as claims, and test the tool on a sample you can check.

Email finders are the plumbing of outbound. You have a list of names and companies, and you need addresses. The market is crowded and the pitch is always accuracy, so it helps to understand what the tools do before you compare them. This post explains the mechanics, the limits nobody can remove, and a simple test you can run before you pay for volume.

How does an email finder work?

Three steps, in different mixes depending on the tool.

1. Gather. The tool collects company domains, employee names and address formats from public sources: company websites, social profiles, directories and public records. ZeroBounce's explainer says finders draw on websites, social media, company directories, public records and shared lists, and notes that some are scrapers while others search databases or guess patterns.
2. Generate. If it cannot find an exact address, the tool builds likely ones from common patterns: first name dot last name, first initial plus last name, first name alone. One name and one domain can give a dozen candidates.
3. Check. The tool tests each candidate. First syntax and whether the domain exists. Then it contacts the recipient's mail server and asks whether the mailbox would accept mail, without sending a message. Findymail's description calls this SMTP verification.

The output is usually a status such as valid, risky or invalid, sometimes with a confidence score.

Why can't a tool verify every address?

Because of the catch all domain. Some mail servers accept mail for any address at the domain and sort it later. On such a server a check always says yes. The address jane.smith@ and qwerty123@ both look valid, though only one reaches a person. A finder can only mark these as risky or unknown. No vendor and no price removes that limit.

Other limits:

• Stale data. A person who changed jobs last month still appears in a database for a while.
• Small firms. Fewer public traces mean fewer matches, and patterns vary.
• Role addresses. sales@ is real but not the person.
• Greylisting and blocks. Some servers refuse the check, which looks like a failure but is not.

What accuracy should you expect?

Honestly, we cannot give you a number, and you should be wary of any who does without showing how it was counted. Findymail's own article claims less than 5% invalid emails and over 90% accuracy in finding the right addresses, and in the same piece concedes that no tool can guarantee 100% accuracy and that users should verify leads before sending. That is a vendor describing its own product, not an independent test.

Accuracy also means different things:

A tool with a low found rate and a high valid rate can still be the right one if you value fewer bounces. A tool with a high found rate and many risky results can cost you reputation. You need both numbers and a label for each result.

How do you test a finder yourself?

An afternoon is enough.

1. Build a labelled sample. Take 100 to 200 contacts whose address you know is correct, such as colleagues, customers or people who have written to you. Hide the answers.
2. Run the tool on name and company only.
3. Score it. Count three things: addresses found, found addresses that match the truth, and results marked risky or unknown.
4. Send a small live batch of the verified addresses, and count bounces. Instantly's 2026 benchmark report advises keeping bounce rates below 2% and pausing to clean the list if they rise.
5. Compare cost per good address, not cost per lookup: total spent divided by addresses that matched or did not bounce.

Do the same for each tool you consider, on the same sample, and keep the labelled list for future checks.

What does the Sellinger database offer?

Sellinger includes a database of 700M+ contacts. You search people and companies by title, location, company and more, check the search cost, and choose what to reveal on import: profile details, a verified email address or a mobile phone. Email, company and person lookups start from $0.01 and run from a prepaid enrichment wallet that starts with a $10 credit. Contact details are charged only when they are found, and a company only result with no contact is not billed. Enrichment is a contact database lookup. It does not run several outside providers in turn.

We have not run a labelled accuracy test, so we publish no accuracy percentage. The honest advice is the one above: run your own sample before you import thousands of leads. See enrichment credits explained for what is charged, and find leads in the contact database for the steps.

How should you read the results?

Treat each label as an instruction.

• Valid. Safe to send, within your normal limits. Still watch the first batch for bounces.
• Risky or catch all. The server accepts everything, so the address may not exist. Send a small test batch, or try another channel for these people.
• Unknown. The server did not answer the check. Retry later, or skip.
• Invalid. Never send. Remove it and note the source so you can see which lists produce them.

Keep the label on the lead record. Three months from now you will want to know whether a bounce came from a risky address you chose to try. A list that shows its own confidence is worth more than one that pretends every row is equal.

When is a finder the wrong tool?

• When you have a LinkedIn conversation already. Ask for the address. See how to find an email address from a LinkedIn profile.
• When the audience is a few dozen named people. Research by hand is better and more accurate.
• When the market restricts cold email. Some places ask for consent, and a found address does not change that. Read whether cold email is legal.
• When the list is the problem. The Green Shield Logistics campaign saw named heads of compliance reply at 8.2%, almost four times the 2.2% of generic clinic inboxes. A finder that returns a general inbox for the wrong role gives you the lower number. See the case study.

A buying checklist

• [ ] The tool labels results valid, risky and unknown, and I can see the label.
• [ ] It states how it treats catch all domains.
• [ ] I ran it on a labelled sample and scored it.
• [ ] I know the cost per good address.
• [ ] I know where the data comes from and whether the vendor says it is lawful to use.
• [ ] A small live batch bounced under 2%.

The best finder is the one that tells you which addresses it does not trust.