A B2B email finder that tells you how sure it is

How to find a work email address

To find a work email address, FoxKnock needs two things: the person's full name and the company's website domain. They come from:

• People search at companies you found.
• A CSV import.
• A contact you add by hand.
• The Chrome extension (installed in developer mode today).

FoxKnock does not scrape LinkedIn and does not use Apollo's API.

Run a find on one contact, or on a selection of up to 2,000 from the contacts table. Contacts that already have an address are skipped. The dialog shows the most the run can cost before you confirm, and you are charged only for the addresses found.

Finds can also be queued when you accept discovery results (up to 50 per click), run by a play when a signal fires, or started from Ask FoxKnock, which asks you to confirm any action above 100 credits.

Each result keeps the provider that returned it, so you can see where an address came from. For the manual methods, see how to find someone's work email.

Email waterfall enrichment: how the search runs

Email waterfall enrichment means asking specialist providers one at a time and stopping when one returns a confirmed address, so a miss at one source gets another chance at the next.

FoxKnock's order is fixed: Icypeas, LeadMagic, Findymail, Hunter, then Prospeo. A provider is skipped when no key for it is configured, so which ones run depends on your workspace. You can add your own keys in Settings, and your key wins over the platform's for your workspace.

Along the way:

• A provider that errors, finds nothing or returns an address it considers invalid is passed over.
• An unconfirmed address (catch-all, risky or unknown) is kept as a fallback while the search continues.
• The first valid result ends the search. If nothing is valid, you get the best fallback: catch-all, then risky, then unknown.

Example (an illustration with a fictional person and domain). You ask for Dana Reyes at northwind.example, with all five provider keys configured. Icypeas finds nothing, so the search moves on. LeadMagic returns an address it calls catch-all, and FoxKnock keeps it as a fallback. Findymail returns a valid address, so the search stops. The find costs 10 credits at default prices, and the contact shows Findymail as the source.

The pattern guess comes last, and only when no provider returned a usable address (one a provider marked invalid does not count). FoxKnock builds the most common pattern, first.last@ at the company's domain when both names are known, and checks that the domain has working mail routing through its MX records. With no mail routing, there is no guess.

The result is risky or unknown, never valid, because DNS can show that a domain receives mail but not that a particular mailbox exists.

Email finder and verifier: what each status means

Finder results arrive with the status the provider gave them. Verification is a separate step. You run it from the contacts table on any address, whether FoxKnock found it or you imported it, and it also runs before sending when an address is stale.

It works in two stages:

1. In-house checks, free. Syntax, a list of disposable domains, MX records (with the fallback to a domain's address record that mail standards allow) and role accounts such as info@ or sales@. An address that fails a hard check is marked invalid without calling anyone.
2. Verifier vendors, in order. MillionVerifier, then ZeroBounce, then Reoon.

A role account is downgraded to risky even when a vendor says valid, because a shared mailbox is not one person's inbox. The in-house checks can rule addresses out but cannot confirm a mailbox: FoxKnock itself does not probe mailboxes over SMTP, so valid always comes from a vendor.

Every address ends up with one of six statuses:

Catch-all, risky and stale addresses

A catch-all domain accepts mail for any address, so a mailbox check cannot say whether one person's mailbox exists. FoxKnock applies your policy: by default at most 10% of the contacts in a sequence can be catch-all, or you can exclude them in Settings under Compliance. The catch-all guide explains why they are risky to send to.

Addresses also go stale, so FoxKnock checks the verification date before each email:

• Last verified more than 14 days ago, or never: it verifies again, once per message, and an address that now fails is not emailed.
• A valid result from a finder counts as verified for those 14 days. A catch-all, risky or unknown find has no verification date, so it is checked before the first email.
• A paid verifier is configured but credits have run out: the message waits instead of going out unchecked.

This matters because bounces count against your mailbox. Sending pauses automatically when a mailbox's bounces pass 2% of its last 100 sends (once it has sent at least 20). A hard bounce on an address FoxKnock found refunds the find credits but still counts toward that limit. See cold email sending for the other guardrails.

Finding an address is not permission to email it

Country rules, lawful-basis checks and suppression checks run at enrollment and again at send, as part of the built-in GDPR tools. They are a starting point, not legal advice, and compliance stays the sender's responsibility.

How this compares with doing it by hand

A single-source finder is limited to what that one source returns. A waterfall by hand means:

• Opening accounts with several providers.
• Running each list through them in order.
• Merging the results.
• Passing the winners through a verifier.
• Importing them into your CRM.

Providers also differ in how they bill and in what they count as a hit.

FoxKnock runs that loop inside the CRM and keeps the source of each address on the contact. It is not a database you can filter by title and industry, so if you need a very large list from one source, a dedicated data provider can fit better. FoxKnock launched in October 2026, and the quality of its waterfall depends on which provider keys are connected.

What it costs at default prices

Credits cost $0.01 each at list price, and credit prices can change, so check the pricing page for the current table. At default prices:

• Find an email: 10 credits, charged only when a valid or catch-all address is found.
• Verify an email: 1 credit, charged only when a verifier vendor returns an answer. The in-house checks are free, and the pre-send recheck costs the same.
• Found and separately verified: at most 11 credits, about $0.11 at list price.
• Hard bounce: the 10 find credits are refunded automatically, once. The 1-credit verification is not refunded, and addresses you imported were never charged.

If you bring your own provider keys, credits are charged the same and the vendor also bills you directly. A monthly spend cap in Billing stops spending at the limit you set. At default prices, the Free plan's 500 one-time credits stretch to about 45 addresses found and verified, fewer if you spend them on other work.

To see how the finder does on your own market, create a free account and run it on a small list with the free credits.