# Catch-All Email: What It Is and Whether to Send to One

> A catch-all email domain accepts mail for any address, so no verifier can confirm a lead there. How to spot one, why it bounces later, and when to send.

Canonical: https://ballast.to/blog/catch-all-email
Last updated: 2026-10-28

A catch-all email domain accepts mail for every address at that domain, including ones that don't exist. Ask its server about `jane@` and about `q7x2k9vz@` and it says yes to both, so an email verifier can't tell you whether Jane has a mailbox there. That's why verifiers mark these leads "catch-all" (some say "accept-all") instead of valid or invalid. For cold email it means one thing: the address might be real, might end up in a shared mailbox nobody reads, or might bounce a few minutes after the server accepted it.

You can still email catch-all addresses. Whether you should depends on where the address came from, which I'll get to after the mechanics.

## What does catch-all mean in email?

The word covers two related things, and the search results mix them up.

The first is a mailbox setting. An admin tells the mail server to deliver anything sent to an unknown address at the domain into one mailbox, so a customer who types `sales@` instead of `sale@` still reaches someone. Google Workspace does this with a routing rule for "All inactive and unrecognized accounts", Zoho Mail has a catch-all address setting, and most hosting control panels have a "default address" that works the same way.

The second is what a verifier reports. To an email verifier, a domain is catch-all when its server accepts every recipient during the SMTP conversation, whether or not there's a catch-all mailbox behind it. A server that accepts everything and sorts it out later looks exactly the same from the outside. Most cold email conversations about catch-alls are about this second meaning.

## How does a verifier know a domain is catch-all?

It asks the server twice. A verifier opens an SMTP connection to the domain's mail server, starts a message, names the address you want checked, then names a random one that can't exist. It hangs up before sending anything. Here's roughly what that looks like:

```smtp
S: 220 mx.example.com ESMTP
C: EHLO verify.example.net
S: 250 mx.example.com
C: MAIL FROM:<probe@verify.example.net>
C: RCPT TO:<jane.doe@example.com>
S: 250 2.1.5 OK
C: RCPT TO:<q7x2k9vz4m@example.com>
S: 250 2.1.5 OK
C: QUIT
```

The server accepted `jane.doe@`, which looks good, and then accepted a string of random letters, which tells you the first yes meant nothing. Compare that with a server that checks its recipients. Gmail answers an unknown address with `550 5.1.1 The email account that you tried to reach does not exist`, and Microsoft 365 with `550 5.4.1 Recipient address rejected: Access denied`. A server that rejects the random address gives a verifier a real answer for the real one.

RFC 5321, the standard SMTP is built on, says this behaviour is allowed: in practice some servers don't check recipients until after they've received the message. Nothing about a catch-all is broken. It just leaves the question open.

## Why do catch-all addresses bounce after the email was accepted?

Because "accepted" only meant the server took the message. If no mailbox and no catch-all rule picks it up afterwards, the server has to tell the sender, and it does that with a delivery failure report sent back to your mailbox. It looks like any other bounce, from `mailer-daemon@` or "Mail Delivery Subsystem", and it can arrive a minute or a few hours after your tool logged the email as sent.

This is the bounce that catches people out. A sending tool that only records whether the send went through will show these emails as delivered. The bounce rate your domain is actually building only shows up if something reads the sending mailbox and matches each report back to the email it refers to.

There's a third outcome too, and it's the quiet one: the domain does have a catch-all mailbox, your email lands in it, and nobody ever reads it. No bounce, no reply. When you see a lot of catch-all leads that never bounce and never answer, that's usually what happened.

## Which email setups answer like a catch-all?

The domain's MX records tell you who receives its mail, and that tells you most of what to expect. You can look them up with [the free MX lookup](https://ballast.to/check/mx).

| Who receives the mail | Unknown address | Looks catch-all when |
| --- | --- | --- |
| Google Workspace | Rejected with `550 5.1.1` | The admin added a routing rule that sends unrecognised addresses to a mailbox |
| Microsoft 365 | Rejected at the edge with `550 5.4.1` | The domain is set to Internal relay, usually during a migration or in a hybrid setup |
| Zoho Mail | Bounced | The admin set a catch-all address |
| Shared hosting (cPanel and similar) | Depends on the setting | The default address forwards to a mailbox instead of rejecting |
| A security gateway in front (Mimecast, Proofpoint) | Depends on the setting | The gateway accepts all recipients and leaves the checking to the server behind it |

Microsoft's case is worth a closer look, because it explains why so few Microsoft 365 domains come back catch-all. Its Directory-Based Edge Blocking rejects mail for addresses that don't exist before any filtering happens, and Microsoft says it's already on when all of a domain's recipients are in Exchange Online. A Microsoft 365 domain that verifies as catch-all is usually halfway through a migration, which also means some of its mail is going somewhere else.

## Should you send cold email to catch-all addresses?

Look at where the address came from, because the verifier can't help you here.

- **The person published it.** It's on their website, in a signature, in a talk's slides. Send. The domain being catch-all doesn't make a real address less real.
- **A data provider found it and you trust that provider.** Send, but in small batches at first, and watch bounces for the first few days.
- **You or a tool guessed it from a pattern.** `first.last@` is a guess, and a catch-all domain is the one place a verifier can't catch a wrong guess. Leave these out, or send a handful and read every bounce before sending more.

Whatever you decide, keep catch-all leads apart from verified ones. Put them in their own campaign, or at least their own batch, so their bounces don't hide inside a clean list's numbers. And keep them away from a new mailbox during its first weeks, when every bounce counts for more.

This is my one strong opinion on the subject: a sending tool should be able to stop you. If a batch of catch-all leads starts bouncing, the campaign should pause on its own, before the bounce rate damages the domain, instead of waiting for you to notice on Monday.

## Can you verify a catch-all email address?

Not by asking the server, since the server says yes to everything. Some services sell "catch-all verification", and it's worth asking how they do it. The honest methods are a database of addresses that have received mail or replied before, or sending something and watching for a bounce, which is the thing you were trying to avoid doing from your own domain.

What does help:

- **Evidence the person uses the address.** It's published somewhere, or they've emailed you from it.
- **A reply from a colleague.** If someone at the same company answered from `firstname@`, you've learned the pattern. You haven't confirmed anyone else's mailbox, but your guesses get much better.
- **Bounce history.** If you've emailed the domain before and nothing came back, that's real information, more useful than any score.

## What do email verifiers call a catch-all?

The label depends on the tool. These are the values each provider's API returns:

| Verifier | Catch-all result | Other results it can return |
| --- | --- | --- |
| MillionVerifier | `catch_all` | `ok`, `invalid`, `disposable`, `unknown` |
| ZeroBounce | `catch-all` | `valid`, `invalid`, `spamtrap`, `abuse`, `do_not_mail`, `unknown` |
| NeverBounce | `catchall` | `valid`, `invalid`, `disposable`, `unknown` |

Don't confuse catch-all with `unknown`. Unknown means the server didn't give a clear answer at all: it timed out, refused the verifier, or asked it to try later. A catch-all server answered clearly. It just said yes to everything.

## Should your own sending domain have a catch-all?

I wouldn't add one. A sending domain only needs the mailboxes you send from, since replies come back to them. A catch-all on it collects every message sent to made-up addresses at your domain, which mostly means spam, and gives you one more mailbox to watch.

The one case people use it for is a retired sending mailbox: you delete `alex@` and the late replies to old emails disappear. Keep the old address as an alias on another mailbox instead. You keep the replies without opening the whole domain.

## When catch-all isn't what's hurting you

If verified-valid addresses are bouncing too, your list source is the problem, not the catch-all leads, and splitting them out won't fix it. If the bounces carry `5.7.x` codes, the receivers are refusing your domain, which is a different problem: start with [soft bounce vs hard bounce](https://ballast.to/blog/soft-vs-hard-bounce) to read the codes, and run SPF, DKIM, DMARC and the blacklists through [the domain check](https://ballast.to/check). And if a list was bought or scraped, catch-all is the least of its problems. Those lists are where [spam traps](https://ballast.to/blog/spam-traps) come from.

## How Ballast handles catch-all leads

You connect your own MillionVerifier, ZeroBounce or NeverBounce key, and verified leads show Valid, Risky, Catch-all or Invalid with the reason ("The domain accepts every address, so this one can't be confirmed"). Campaigns have a Skip risky leads setting that leaves catch-all addresses and shared inboxes out when you add leads, and again before their first email if a later check flags them. Ballast also reads each sending mailbox for delivery reports, so a catch-all that bounces later is counted against the right email, and a campaign pauses at a 5% bounce rate by default. The details are in the [leads docs](https://ballast.to/docs/leads#verification) and the [campaign settings](https://ballast.to/docs/campaigns#settings).

## FAQ

### What is a catch-all email address?

An address at a domain whose mail server accepts mail for any address, real or not. Mail to unknown addresses goes to one shared mailbox, or is accepted and bounced later.

### Is a catch-all email valid?

It might be. A verifier can't tell, because the server accepts every address the same way. Treat it as unconfirmed, not as invalid.

### Do catch-all emails bounce?

Some do. The server accepts the email first, and if nothing on its side takes the message, it sends a delivery failure report back to your mailbox, sometimes hours later.

### Is catch-all the same as accept-all?

Yes. Accept-all is another name for the same verifier result: the domain accepted a random address it couldn't have had, so the check on your address proves nothing.

### Should I remove catch-all emails from my list?

Remove the ones you guessed from a pattern. Keep the ones the person published or a trusted provider found, and send to them in small batches separately from your verified leads.

### How do I check if a domain is catch-all?

Run the address through an email verifier, which tests a random address at the same domain for you. The domain's MX records also hint at it: Microsoft 365 domains rarely are, domains behind a security gateway often are.

## Sources

- [RFC 5321: Simple Mail Transfer Protocol](https://www.rfc-editor.org/rfc/rfc5321.html), section 3.3 on servers that verify recipients after the message.
- [Use Directory-Based Edge Blocking to reject messages sent to invalid recipients](https://learn.microsoft.com/exchange/mail-flow-best-practices/use-directory-based-edge-blocking), Microsoft Learn, checked 28 October 2026.
- [Get misaddressed email in a catch-all mailbox](https://knowledge.workspace.google.com/admin/gmail/advanced/get-misaddressed-email-in-a-catch-all-mailbox), Google Workspace Admin Help, updated 26 October 2026, checked 28 October 2026.
- [Catch-all address setup](https://www.zoho.com/mail/help/adminconsole/catch-all-setup.html), Zoho Mail admin help.
- [Gmail SMTP errors and codes](https://knowledge.workspace.google.com/admin/support/troubleshooting/gmail-smtp-errors-and-codes), Google Workspace, checked 25 October 2026.
- Verifier result values from the [MillionVerifier](https://developer.millionverifier.com/), [ZeroBounce](https://www.zerobounce.net/docs/email-validation-api-quickstart/) and [NeverBounce](https://developers.neverbounce.com/) API documentation.