A catch-all email address is a domain-wide setting that accepts mail sent to any address at your domain, including addresses nobody ever created. Write to sales@, to typo@ or to complete-nonsense@ and every message lands in the same mailbox. It is genuinely convenient, but it also turns your domain into a spam magnet and it quietly breaks the way email verification works.
If you have ever run a list through an email validator and seen results marked "accept-all" or "unknown" instead of a clean valid or invalid, you were almost certainly looking at a catch-all domain. Here is what is happening underneath, and what to do about it.
What a catch-all does on the mail server
Normally a mail server keeps a list of the mailboxes that exist on a domain. When a message arrives for an address that is not on that list, the server refuses it and the sender gets a bounce. A catch-all removes that check: the server stops asking "does this mailbox exist?" and simply says yes to everything, then delivers the mail to one designated inbox, a shared folder or a distribution group.
Most hosting control panels expose this as a single switch, labelled "catch-all address", "default address" or something like *@yourdomain.com. Turning it on takes about ten seconds, which is a large part of why so many small domains have one without anybody ever deciding to.
Why people set them up
- Typos still reach you. A customer who writes salse@ instead of sales@ gets through instead of receiving a bounce they will never read.
- Unlimited addresses for free. You can hand out bank@, newsletter@ or shopname@ to every service you sign up for, without creating a mailbox for each one.
- Nothing to maintain. New department, new project, new contractor: no need to touch the mail server first.
The two real downsides
It is a spam magnet
Spammers run dictionary attacks: they take a domain and fire messages at info@, admin@, hr@, john@, maria@ and a few thousand other guesses. On a normal domain almost all of that is rejected at the door. On a catch-all domain every single guess is accepted, which means you filter it, store it and eventually wade through it.
Verifiers cannot confirm individual mailboxes
Email verification works by asking the receiving server whether one specific mailbox exists. On a catch-all domain the server answers yes to every address, so a verifier genuinely cannot tell anna@company.com apart from anna.typo@company.com. Honest tools do not pretend otherwise: they return accept-all, unknown or risky instead of inventing a verdict. That is a limit of the protocol, not a flaw in the tool.
The practical effect is that catch-all addresses inflate the risk profile of your list. You cannot prove they are deliverable, and if you treat them as clean and send a big campaign, some of them will bounce. That is why sorting them out is a normal step in verifying an email list before sending.
How to tell whether a domain is catch-all
The simplest test is to check an address that certainly does not exist. Invent something absurd, such as zzq-not-a-real-person@thedomain.com, and run it through a validator. If a made-up address comes back valid or accept-all, the domain is a catch-all. If it comes back invalid while a known good address comes back valid, that domain is checking its mailbox list properly.
What to do with catch-all addresses on a list
- Segment them. Keep accept-all results in their own group rather than mixing them into your clean, verified audience.
- Warm up at low volume. Send to a small slice first and watch the bounces before you send to the rest.
- Watch engagement, not delivery. A catch-all inbox accepts everything, so "delivered" tells you almost nothing. Opens, clicks and replies tell you whether a human is there.
- Retire the silent ones. If an accept-all address has never engaged after several sends, remove it.
Accept-all results also tend to travel together with role-based addresses such as info@, office@ or support@. Both belong in the same cautious segment: technically reachable, but not a named person who asked to hear from you.
The modern alternative
- Aliases. Create a fixed set of real aliases pointing at your mailbox. They are enumerable, so verification still works, and you can delete one the moment it starts attracting spam.
- Plus-addressing. Many providers let you use you+shop@yourdomain.com. It is free and instant, though some sign-up forms reject the plus sign and anyone can strip it.
- A disposable address. For one-off downloads, trials and forum sign-ups, use a temporary inbox such as 1mail.lt and never expose your real address at all.
Together those three cover almost every legitimate use of a catch-all without permanently opening your domain to everyone. If you are not ready to switch yours off, at least check your own domain with the email validator so you know exactly what other people's tools see when they look at you.
FAQ
Is a catch-all bad for deliverability?
Not directly, because your own sending reputation is what matters when you send. The problem is on the receiving side: a catch-all collects large volumes of spam, which makes filtering harder and can bury real mail. And when other people verify addresses at your domain, they get an accept-all result that many senders treat as risky.
Can any tool verify a single mailbox on a catch-all domain?
No. The server says yes to every address, so there is nothing to measure. Any service claiming a definitive verdict there is guessing. The honest answer is accept-all, and you handle it by segmenting and testing rather than by trusting a label.
Should I turn my catch-all off?
For most small domains, yes: replace it with a handful of real aliases plus one forwarding address for typos. If you keep it, route it to a mailbox with aggressive filtering that nobody relies on for real work.
Does a catch-all hide which addresses exist?
It does stop attackers from mapping your mailboxes by watching which guesses bounce, which is a small genuine benefit. But it does not stop them sending mail to those guesses, so you trade a little reconnaissance for a lot of inbox noise.
