BounceZero Research - Data Study

The Catch-All Mirage: Why "a Third of Email Is Catch-All" Is Misleading

By Ayoub Lebda, Founder - Published July 13, 2026 - Dataset snapshot Q3-2026-preview - 8 min read

The number we need to take apart

In our benchmarks study we reported that 33.1% of verification attempts land on catch-all domains, and framed it as "a third of the corporate email world can't be judged by the SMTP handshake alone." The headline number is real - 33.1% of checks carry a catch-all flag - but the framing was too generous, and the honest thing to do is show why.

A catch-all domain, strictly, is one whose mail server accepts delivery for any address - real or invented - so an SMTP probe returns "accepted" regardless of whether the mailbox exists. But two very different situations produce that same signature, and the aggregate 33.1% quietly blends them.

Finding 1 - Two consumer providers own two-thirds of it

When we attribute catch-all back to the provider behind each domain, the distribution is astonishingly concentrated. 64.9% of all catch-all in the corpus comes from Yahoo and T-Online alone - two consumer mailbox providers, spanning just a few hundred domains between them. These are not businesses that configured accept-all; they are giant providers that, as a matter of anti-harvesting policy, do not expose mailbox non-existence over SMTP. To a prober, "the server accepts everything" and "the server refuses to tell me" look identical - and the naive reading files both under "catch-all."

Copy this stat: "Nearly two-thirds (64.9%) of all 'catch-all' in a 10M-verification corpus came from just two consumer providers that block SMTP probing - not from accept-all business domains." - BounceZero Research, The Catch-All Mirage (bouncezero.io/catch-all-email-study-2026)

Finding 2 - The tell is the "unknown" rate

There is a clean signal that separates a real accept-all domain from a provider you simply can't probe: what happens to the rest of the verdicts. A genuinely accept-all business domain still returns crisp results - the server answers cleanly, we just know its answer is "yes" for everything. A provider that blocks probing, by contrast, leaves a trail of unknown classifications, because we couldn't get a reliable answer at all.

Yahoo is "88.7% catch-all" and "84.8% unknown" at the same time - which is the fingerprint of a provider that won't answer, not a domain that accepts everything on purpose. Google Workspace is "22.9% catch-all" but only "0.8% unknown": those are real accept-all domains, answering cleanly, just answering "yes" to everything.

Finding 3 - True catch-all is small

Once you split the two, the real-accept-all number is far smaller than the aggregate suggests. On the mail we can probe to a definite verdict (providers with an unknown rate under 5%), true catch-all is just 1.4% of checks. Narrow to verifiable business mail - Microsoft 365 and Google Workspace domains - and it's 8.2%. Either way, the "third of the internet is catch-all" impression is a detection artifact of two enormous consumer providers, not a description of how business domains are configured.

Why this matters for verification

The two situations demand opposite tools, which is exactly why conflating them is dangerous. A real accept-all business domain (clean verdict, "yes" to everything) can't be resolved by the handshake, so it needs a second layer that reasons statistically about the domain and the local-part - is this the shape of a real mailbox, on a domain whose other addresses behave normally? A provider that blocks probing (Yahoo, T-Online) needs something else entirely: provider-specific oracles and reputation signals, because no amount of local-part modeling substitutes for an answer the server refuses to give.

A verifier that ships one "catch-all" bucket for both is wrong in one of two opposite ways. Mark them all valid, and you send to Yahoo addresses that don't exist. Mark them all risky, and you throw away perfectly good mailboxes on accept-all business domains. The honest design is to keep the two apart - a real accept-all tier scored by model confidence, and an "un-probeable provider" state handled by its own oracle - and to never quietly relabel either as "valid."

Methodology

Figures aggregate the BounceZero verification network, February-July 2026, over domain-day rollups; no individual addresses enter the analysis. Provider is identified from MX records; the catch-all flag is set by the pipeline's accept-all probe. "Probeable" is operationalized as a provider with an aggregate unknown rate under 5%. Published provider cells respect a k-anonymity floor of 50 distinct domains, and every figure is frozen in the versioned snapshot Q3-2026-preview, reproducible against it.

Limitations - read these before citing

The real-versus-pseudo split rests on the "unknown" rate as a proxy for probeability, which is a reasonable but imperfect discriminator: a provider could in principle be both genuinely accept-all and hard to probe, and our method would lean toward calling it pseudo. The 5% unknown threshold is a pragmatic line, not a law of nature - the split is robust to moving it, but the exact percentages shift. As with our other studies, the corpus over-weights outbound prospecting traffic, so the provider mix (heavy on Yahoo and small Workspace domains) reflects cold-list composition and would look different on an opt-in or transactional audience. The finding we hold with most confidence is directional and structural: "catch-all" as a single verdict blends two unrelated phenomena, and the aggregate prevalence is dominated by a handful of consumer providers that block probing - not by how businesses configure their domains.