How to Find an Email Address with Proof of Source

Most email finders give you an email and a confidence score. What they don't give you is the page the email came from. Which is weird, because that's the thing you actually need to verify before sending a big pitch or making an introduction.

This guide walks through three ways to find email addresses that are either free or cheap, and shows why having a source URL is the thing that separates "I have an email" from "I have an email I'd bet money on."

Why the source URL matters

Imagine you're about to pitch a big account. You've got the CEO's email from a finder tool. Confidence score: 92%.

Without a source, all you know is "the tool thinks this is real."

With a source, you can:

• Verify the page still exists. Contacts change. An email on last year's about page might not be active today.
• Read the context around the email. The CEO's bio next to their email tells you what they work on, what company they're at now, and how recently they posted.
• Customize your pitch. "I saw your post about [thing] on [page]" is the best cold open there is.
• Catch the obvious fakes. If the "source" is a dev staging site or a comment thread from 2019, that's a flag.

One verified source worth ten confidence scores.

Method 1: Manual research

For single, high-value prospects, nothing beats 20 minutes of manual work.

Step 1: Start with their domain

Type companyname.com/about or companyname.com/team. Most companies have one. Check:

• About page
• Team page
• Contact page (sometimes a contact form but sometimes direct emails)
• Press or media page

Step 2: Check their footer

Most sites have the company email in the footer. Usually info@, hello@, or a named address. Even if you need to reach a specific person, the footer tells you the company's email pattern.

Step 3: Check their LinkedIn bio

LinkedIn bios sometimes have "contact me at [email]" in plain text. The profile owner wrote it themselves, so if it's there, it's real.

Step 4: Check their GitHub

For technical roles, GitHub is a goldmine. github.com/username has a public email in the profile sidebar if they've set one. And any git commit shows the email they committed with. Run git log --format='%ae' on their repos and you have a list.

Step 5: Check their personal website

Senior people often have a personal site. These usually have a contact email or a mailto link in the footer.

Step 6: Check Twitter and Mastodon

Less common, but some people put "[first]@[last].com" directly in their bio. Takes 10 seconds to check.

Time cost: 10-20 min per contact. Accuracy: 80-90% when you find something. Best for high-value individual targets.

Method 2: Pattern prediction

Most companies use one of about 20 email patterns:

1. [email protected]
2. [email protected]
3. [email protected]
4. [email protected]
5. [email protected]
6. ... and so on

If you can find one email at a company (say, the CEO or a marketer you've already emailed), you can predict the pattern and apply it to any employee.

How to apply the pattern

1. Find one known email at the company. Look at their careers page, PR releases, or a LinkedIn "contact info" section.
2. Figure out the pattern. [email protected] tells you first.last@domain.
3. Apply to your target. If you're trying to reach Bob Johnson, try [email protected].
4. Verify with SMTP. Before sending, use a free SMTP verifier (Clearout has a free tier) to check if the mailbox actually exists.

Time cost: 5 min per contact once you know the pattern. Accuracy: 60-80% depending on company. Best for mid-size targets where patterns are consistent.

Where this breaks

Catch-all domains accept any email at the domain. Your SMTP verifier will say "valid" even for made-up addresses. If the domain is catch-all, pattern prediction is unreliable.

Method 3: Using an email finder with citation

If you want to skip the 20 minutes of manual research and still have proof of source, this is where tools come in. Not all of them show sources.

Here's what to check when picking one:

• Source URL field in the API response. Open the docs. If the tool doesn't document a source_url or citation field, it probably doesn't provide one.
• Click-through verification. Good tools let you click the source link and see the page in your browser. If the link is dead or behind a login, flag it.
• Multi-channel support. If the tool only finds emails, you're still missing LinkedIn, GitHub, and Twitter DMs.
• Pay-per-success pricing. You shouldn't pay credits for zero results, especially while you're evaluating.

Orit specifically

Full disclosure: I built a tool called Orit that was designed around this exact problem.

• Every result has a source URL. Click it, see the page, verify.
• 25+ channel types (not just email).
• Finds contacts that single-page tools miss, through multi-source cross-reference.
• Pay-per-success: zero results means zero credits charged.
• Free tier: 50 credits per month.

You can try it at orit.app without signing up (5 free searches per day).

How to verify an email you already have

Sometimes you have an email (from a finder, from a list, from a guess) and just want to verify it's real. Three layers of verification, in order of rigor:

Syntax check

Does it look like an email? [email protected]? This is the cheapest check.

DNS MX lookup

Does the domain have a mail server configured? Run:

dig MX gmail.com

If there are no MX records, the domain doesn't accept email. Skip.

SMTP verification

Connect to the mail server and ask "does this mailbox exist?" without actually sending anything. The server responds with:

• 250 OK: mailbox exists (send with confidence)
• 550 No such user: mailbox doesn't exist (don't send)
• 252 Cannot verify: catch-all domain (proceed at your own risk)

You can do this manually with telnet but most people use tools. Clearout, NeverBounce, and ZeroBounce are the standards. Orit bundles this into every search.

Catch-all detection

Some domains are "catch-all" - they accept mail to any address and either forward it or bounce it silently. SMTP verification will say "OK" to any email at a catch-all domain, so you can't trust it.

Good email finders flag catch-all status explicitly. If your tool doesn't, test the domain with a made-up address ([email protected]) - if it verifies, the domain is catch-all.

Common failure modes

The email was on a stale page. The employee left two years ago, but the team page wasn't updated. Source URL + a glance at "last updated" date catches this.

The email is a role, not a person. [email protected] might technically exist but nobody checks it. Prefer personal emails (firstname.lastname@) over role emails (info@, support@).

The email was extracted from a PDF or image. Text extraction from PDFs is lossy. Letters get swapped (rn becomes m, cl becomes d). Always double-check extracted emails before sending.

The domain has split MX records. Some companies use separate mail servers for different departments. An email that looks valid might still not reach your target. Rare, but check the company org chart or contact page.

Recap

To find any email with confidence:

1. Start manually if the contact is high-value. 20 minutes of research is the highest-accuracy method.
2. Use pattern prediction for mid-size lists. Find one email, apply the pattern.
3. Use a tool with citation (like Orit) if you need speed and source verification together.
4. Always verify with SMTP and check for catch-all before sending.

The source URL isn't a nice-to-have. It's the thing that lets you trust an automated result.

---

Try Orit free: orit.app

Every result comes with a clickable source URL. 50 credits per month on the free plan. Pay-per-success means you only pay when we find something.