What is a catch-all email, and should you send to one?

A catch-all email domain, also called accept-all, is a domain whose mail server accepts mail for any address at that domain, whether or not a mailbox with that name exists. Because the server says yes to everyone, a standard verification check can't tell a real person from a made-up address there. Verifiers detect catch-all domains by asking about an address that cannot exist; if the server accepts it, every yes from that domain is unreliable.

Catch-all addresses are not bad addresses. They are uncertain ones. This guide explains how they work, why they make lists risky, and a practical policy for sending to them.

How accept-all servers work

On a normal domain, the mail server checks each recipient against its directory. Ask about jon.reyes@harborlane.com and the server either accepts the recipient or rejects it because no such mailbox exists. That rejection is what makes verification possible.

A catch-all domain skips or delays that directory check. There are a few common reasons:

• A deliberate catch-all mailbox. Small companies often route every unknown address to one shared inbox so that misspelled names still reach someone. Mail to jon.reyse@harborlane.com lands in the same place as mail to a real colleague.
• A security gateway in front of the real server. Gateways such as Proofpoint or Mimecast accept mail at the edge, scan it, and pass it on. Depending on how they are set up, they may accept every recipient and leave the real check to the server behind them.
• Directory checks turned off. Some hosted setups, including certain Microsoft 365 tenants, are configured to accept mail for unknown recipients first and decide later. The domain looks like a catch-all from the outside even if nobody intended it.

In the first case the mail is delivered somewhere. In the other two, mail to a nonexistent person is accepted during the SMTP conversation and then bounced back to the sender minutes later as a delivery failure notice.

Why catch-all domains make lists risky

The trouble is that the answer you get during verification is the same for real and fake addresses:

• Accept-then-bounce. The server accepts the recipient while you verify, then rejects the actual message after the fact. To mailbox providers and to your sending tool, that still counts as a bounce.
• Silent drops. Some catch-all setups accept the message and quietly discard it, or deliver it to a shared inbox nobody reads. You get no bounce and no reader.
• Guessed addresses pile up. Lists built from name patterns, like first.last at the company domain, are full of addresses that look right but were never confirmed. On a catch-all domain nothing pushes back on a wrong guess.

If you treat catch-all results as valid, every guessed address on those domains goes into your campaign unchecked. That is how a list that verified clean still produces a noticeable bounce rate.

How the made-up address test works

The detection method is simple and you can reason about it yourself. During the same SMTP session that asks about the real address, the verifier also asks about one that cannot exist:

Real address:    jon.reyes@harborlane.com            -> accepted
Made-up address: zq81-not-a-person-7k@harborlane.com -> accepted

Result: harborlane.com accepts every address, so the first
"accepted" says nothing about Jon.

If the made-up address is rejected, the server is doing real directory checks and the answer for the real address can be trusted. If it is accepted, the domain is a catch-all and the real address gets a catch-all verdict instead of valid.

Two details matter in practice:

• The result belongs to the domain. Once you know harborlane.com accepts everything, every other address there will get the same answer, so there is little point in repeating the live test for each one in the same week.
• Domains change. A company can move to a new mail provider or tighten its gateway, so a catch-all label from months ago may no longer be true. Re-test before a large send.

What a deeper catch-all check does

The made-up address test tells you that a domain accepts everything. It does not tell you whether Jon in particular has a mailbox. A deeper catch-all check goes past the blanket yes and tries to get a clear valid or invalid answer for that one address.

That work takes longer than a regular check, usually minutes instead of seconds, and it can't always reach a conclusion. Some addresses will still come back unclear. That is a fair outcome to plan for: use the clear answers, and keep the unclear ones in the uncertain pile.

Because it costs more time and effort, a deeper check makes the most sense for addresses that are worth it: named contacts at target accounts, senior buyers, or anyone you plan to follow up with several times. Running it on every catch-all row of a large, low-value list is rarely worth the spend.

A practical policy for sending to catch-all addresses

You don't need to drop catch-all addresses, and you shouldn't treat them as valid. Give them their own lane:

A few rules keep the risk contained:

1. Send your valid segment first, then catch-all addresses in a separate, smaller batch.
2. Never put catch-all addresses in the first sends from a new domain or a newly warmed mailbox.
3. Watch bounces per batch. If a catch-all batch bounces noticeably more than your valid batch, stop and tighten the rules.
4. Add every hard bounce to your suppression list so a catch-all guess that failed once is never mailed again.

For the wider list workflow, including how to treat unknown, role and disposable results, see the email list cleaning checklist.

Catch-all checks in BounceOwl

Every BounceOwl result includes the catch-all test, so catch-all addresses show up as their own verdict instead of hiding inside valid. Once a domain is known to be catch-all, the next address there is marked catch-all for free for 7 days, without another live check.

The deeper check is never automatic. You run it on demand on a single result, on selected rows, or on all catch-all rows of a list. A clear valid or invalid answer costs 5 credits, and unclear answers, or no answer within 30 minutes, are refunded. You can read more on the catch-all email verification page, run it from code with the API, or see the current costs on the pricing page.