What is a catch-all email domain?

A catch-all domain (also called an accept-all domain) is a domain whose mail server accepts mail for every address on that domain, whether the specific mailbox exists or not. If you send to typo@example.com on a catch-all domain, the server responds with "yes, I accept that," and the message may or may not actually reach a real inbox.

Catch-all setups are common at companies that don't want to lose legitimate mail to typos. Someone emailing j.smith@company.com instead of john.smith@company.com still has their message accepted, often forwarded to a general inbox or sorted by an admin. Useful for the company. Frustrating for email verifiers, because the standard SMTP handshake cannot tell the difference between a real mailbox and a catch-all accepting a fake one.

In our verification results, catch-all addresses get a confidence score of around 71 — flagged separately from Safe (98) because we cannot confirm the specific mailbox exists, even though the domain accepted the connection.

Why this matters for your campaigns

Free SMTP testers usually report catch-all addresses as "valid" because the server accepted the test. If you trust that label and send a campaign, three things can happen:

• The address is real and your message reaches an inbox. Fine.
• The address is fake (the catch-all collected it, then dropped or quarantined it). Your message goes nowhere. You do not get a bounce, you do not get an open, the metric just shows as "delivered, never engaged."
• The address is a spam trap. Spam traps are often deployed as fake addresses inside catch-all domains. Hitting one tanks your sender reputation.

The second and third cases are why we flag catch-all addresses separately instead of bundling them under Safe. You get to decide how to handle them based on your risk tolerance and what you know about the domain.

How to handle catch-all addresses

Three reasonable strategies, in order of caution:

1. Skip them entirely on cold outreach. If you have no relationship with the recipient and no signal that the address is real, the risk is not worth the small upside.
2. Send to them but watch engagement. Send the first message, then remove anyone who does not open or click within two sends. The engaged ones are real; the rest were typos or spam traps.
3. Verify them through a second method. If you have a phone number, name, or other identifier for the contact, confirm the address through a non-email channel first.

For double-opt-in lists where the subscriber confirmed their address themselves, catch-all flags are usually safe to ignore. The risk profile is different for cold outreach versus warm lists.