The Email Waterfall tries evidence in order: publicly published same-domain addresses, existing CRM evidence, transparent name/domain patterns, MX checks and optional non-sending SMTP verification.
Every result keeps its source and confidence. An inferred pattern remains inferred until independent evidence supports it.
Use Native Prospecting → Lead Finder to identify people a company has published in structured data, then run the waterfall for the selected person and domain.