TL;DR
- A catch-all (or accept-all) domain accepts mail for every address, including ones that don't exist.
- A verifier detects it by asking about a random address that can't exist. If that's accepted too, the domain is catch-all.
- Because the "yes" means nothing, catch-all addresses can't be confirmed. We mark them risky with the reason
low_deliverability.
The short definition
Every email address has two parts: the mailbox (jane) and the domain (acme.com). Normally the domain's mail server
knows which mailboxes exist and refuses the ones that don't. A catch-all server skips that check. It accepts mail for
[email protected], [email protected] and [email protected] alike, then decides later what to do with it.
"Catch-all", "accept-all" and "accept all" all mean the same thing. Some tools say "catch-all domain", some say "catch-all address". The behaviour belongs to the domain, so every address on it inherits the label.
Why companies set up catch-all domains
- So misspelled mail still arrives. Mail to
[email protected]lands in a shared inbox instead of bouncing. - Security gateways. Some filtering services in front of the real mail server accept everything at the door and sort it out afterwards.
- Hiding the staff list. If the server never says "no such user", outsiders can't probe it to find out who works there.
- Old defaults. Some hosting setups enable it and nobody turns it off.
The result is that catch-all domains are common in B2B lists. In Hunter's published sample (checked 2026-10-17), 38% of domains were accept-all.
How a verifier detects a catch-all domain
Verification works by opening an SMTP conversation with the domain's mail server and asking whether it will take mail for an address, without ever sending a message (how verification works). To test for catch-all, we ask about one more address in the same session: a random 16-character mailbox that nobody would ever use.
RCPT TO:<[email protected]> → 250 OK
RCPT TO:<[email protected]> → 250 OK (a mailbox that can't exist was accepted)
= catch-all domainIf the random address is refused (usually 550 5.1.1) and the real one is accepted, the server is checking mailboxes properly
and the "yes" for Jane can be trusted. If both are accepted, the "yes" carries no information.
What happens to mail sent to a catch-all
One of three things: it reaches a real person, it lands in a shared or unmonitored inbox, or the server accepts it and sends a bounce later. That late bounce still counts against you in your sending platform. In Hunter's test, accept-all addresses bounced 27% of the time, compared with 1% for addresses verified as valid.
How MailExchange labels catch-alls
| What the server said | Our result |
|---|---|
| Real address accepted, random address refused | deliverable (or risky: low_quality if it's a role address like info@) |
| Real address accepted, random address accepted | risky: low_deliverability (catch-all) |
| Real address refused | undeliverable: rejected_email, even on a catch-all-looking domain |
Catch-all is kept separate from the other risky reasons (role and disposable), so you can filter it on its own. See the full list in email verification statuses.
What to do with catch-all addresses
- Keep them out of your main campaign so they can't push its bounce rate up.
- Don't send them from new domains. Use established inboxes and low volume.
- Watch the first few hundred sends and stop the segment if bounces climb.
The full playbook is in should you send cold email to catch-all addresses?