# Email Intelligence

> Techniques for harvesting and analysing email addresses to map identities, infer infrastructure, validate accounts, and uncover organisational relationships via OSINT methods.

- **URL:** https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence
- **Path:** OSINT > Identity & People Intelligence
- **Up:** [Identity & People Intelligence](https://hackindex.io/platforms/osint/identity-and-people-intelligence.md)
- **Published:** 2026-04-11
- **Updated:** 2026-08-11

## What This Is

Email intelligence covers the full workflow of finding, verifying, and extracting value from email addresses during an OSINT investigation. An email address is one of the most useful identifiers available: it can confirm a real name, link accounts across platforms, reveal infrastructure, expose breach history, and map an organisation's internal structure.

This phase sits at the intersection of identity research and infrastructure mapping. The techniques here apply equally to individual subject profiling and to corporate reconnaissance.

## When to Use This

Use email intelligence when you have any of the following starting points:

- A name and organisation you want to find contact details for
- An email address you want to verify or attribute to a real identity
- A domain you want to map the email structure of
- A suspected email address from a breach or leaked dataset
- An email header from a received message you want to trace

## The Workflow

Email intelligence runs in four stages. Discovery finds candidate addresses. Verification confirms which addresses are live. Identity resolution attributes addresses to real people or accounts. Infrastructure analysis maps the domain's email setup to understand the organisation and identify further attack surface.

Each stage feeds the next. A verified email from discovery can be run through breach databases in the resolution stage. Infrastructure analysis often reveals additional email patterns that expand the discovery stage on the same domain.

## Subpages

- [Email Address Discovery and Harvesting](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-discovery): find email addresses associated with a person or organisation
- [Email Verification and Validation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-verification): confirm whether a discovered address is live and deliverable
- [Email-to-Identity Resolution](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-identity-resolution): attribute an email address to a real person using breach data and header analysis
- [Email Infrastructure Analysis](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-infrastructure-analysis): map MX, SPF, and DMARC records to profile an organisation's email setup

## OpSec Note

Some verification techniques send a live request to the target mail server. This is visible in server logs and can alert a target organisation's security team. Use disposable infrastructure for any active verification steps and be aware that SMTP probing from the same IP across multiple domains is a detectable pattern.

## Steps

- [Email Address Discovery and Harvesting](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-discovery.md): Techniques for discovering and harvesting email addresses from public sources to map organisational attack surfaces and identify exposed personnel.
- [Email-to-Identity Resolution](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-identity-resolution.md): Maps email addresses to real identities using breach data, social platforms, username enumeration, and metadata analysis to build comprehensive target profiles.
- [Email Infrastructure Analysis](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-infrastructure-analysis.md): Analyze email infrastructure using DNS records, MX configurations, SPF/DKIM/DMARC policies, and mail server fingerprinting to map organizational email systems.
- [Email Verification and Validation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/email-intelligence/email-verification.md): Techniques for verifying email address validity, ownership, and breach exposure using OSINT tools, DNS analysis, and passive reconnaissance methods.