ZapBounce and Power Automate
Power Automate runs inside the Microsoft tenant, which is also where a lot of the addresses it processes live. That produces a result worth explaining before someone files a bug about it.
Microsoft 365 throttles and blocks SMTP verification probes from cloud addresses. So addresses at Microsoft-hosted domains, including possibly your own, frequently come back unknown.
Microsoft throttles probes, including probes at Microsoft domains
An address at a Microsoft-hosted domain often cannot be resolved by any external verifier, because the receiving side rate-limits or refuses probe traffic from cloud IP ranges.
Reporting that as unknown is the accurate answer. A verifier that returned valid for those addresses would be guessing, and the guess would look better in a report and perform identically in a send.
Those results are never billed, so a Microsoft-heavy list costs less to check than its row count suggests. It also has lower coverage, and knowing why prevents a wasted investigation.
How the data moves
Use the HTTP action with a connection reference
Store the key in Azure Key Vault and reference it, rather than putting it in the flow definition where anyone with edit access can read it.
Handle the unknown branch explicitly
A switch on the verdict with a case for unknown, rather than an if-valid-else that treats unknown as a rejection.
Write the verdict to Dataverse or a SharePoint list
Wherever the flow's records live, so the verdict is queryable rather than existing only in the run history.
Batch through a scheduled flow for list work
A recurrence trigger that submits a batch and a separate flow with an HTTP request trigger for the completion webhook.
Setting it up
- Store the API key in Azure Key Vault and reference it from the flow.
- Add an HTTP action calling the verify endpoint with the key in a header.
- Add a switch on the verdict with an explicit unknown case.
- Write the verdict to Dataverse or the list the flow already uses.
- For bulk, build a scheduled flow that submits a batch and a second flow to receive the webhook.
- Document the expected unknown rate for internal addresses so nobody reports it as a defect.
Power Automate: common questions
Why are our own staff addresses unknown?
Because Microsoft 365 throttles verification probes from cloud addresses. That is the receiving side, not a failure on ours, and those results are not billed.
Should unknown block a flow?
Rarely. It means no answer was available, not that the address is bad. Record it and continue.
Where should the key live?
Azure Key Vault, referenced from the flow. A key in the flow definition is visible to anyone who can edit it.
Check a Power Automate export today
100 free checks a month, no card. Unknown results and duplicates are never billed.