PR hack: How to verify an email address exists

When building media lists and otherwise trying to reach reporters on behalf of clients, it’s sometimes useful to be able to find out whether or not an email address is functional.

In a perfect world, every byline at every outlet would include contact information. After all, it’s imperative for those working in the PR field to read reporters’ stuff before initiating any contact. But the PR world is far from perfect. It isn’t obvious how to reach some reporters, particularly those who cover niche topics for trade outlets that have multiple titles.

So, we’re left to guess the email address of reporters and editors when we can’t find through other means. You can send the guessed email address a message and see if there’s a bounce-back, but this is time-intensive because you have to write a coherent email.

The alternative is to use the command line to find out if it’s functional, which takes a couple minutes. 

The command line, essentially, is a way for your computer to talk to other computers by giving it commands instead of clicking on pictures and other things. Ever seen The Matrix? The command line is like what Keanu Reeves’ character Neo sees when he becomes self-aware. 

Using my own email address, here’s an example of how to verify an email address exists using the command line. I use the Terminal application in Apple, but any command line application will do.

Step 1: You tell your computer to find the MX record for the domain whose email address you want to verify. Email is typically routed through different servers than internet traffic is, and by asking for the MX record, you’re essentially telling it to find out where the email server for a given domain is located.

nslookup –type=mx

Here’s what it tells you:

It says this because Clear uses Google as its email host; those locations are mail servers that Google operates. Some media outlets outsource email to Google, too, but others don’t. 

Step 2: You ping the mail server you just identified. Note that you’ll usually see more than one MX record — this prevents email latency and reduces risk in case one mail server goes down for whatever reason — so you’d just pick one. 

This command makes your computer talk to a mail server without sending it an actual email. 

telnet 25 

It’ll either connect and tell you it’s connected or not connect and tell you it’s not connected. Obviously, the first is good and the other is bad.

Step 3: You get the mail server to talk back by saying hi to it and getting it to respond affirmatively. I’m entirely serious. Say hello — in command-line parlance, HELO. 

Step 4: You tell the mail server you’re talking to who you are — or you just make something up. At this point, your computer has already established access to the mail server, and it doesn’t matter if the sender ID is real or fake. This is, however a necessary step in the process.

Step 5: Finally, do what you’re here to do and guess the email address of a reporter or editor who doesn’t want their’s listed publicly. You do this by asking the mail server if it can reach the address you specify. 

If you’ve guessed right, it’ll tell you it can reach that address. If you guessed wrong, it’ll tell you it can’t. 

A few caveats: This hack is primarily for U.S.-based sites, and it won’t work 100% of the time. Some mail servers, such as Hotmail, simply don’t permit computers to talk to them in this way, and I suppose there are probably some freelance writers out there who still use Hotmail. 

It’s just a quick and dirty way to dig up contact info if you’re out of other options and don't want to pay $5,000 per year to Cision for a glorified email directory. 

Andrew Graham