A catch-all domain accepts every email sent to it - including addresses that don’t exist. Standard SMTP verification can’t tell valid from invalid on these servers. This guide explains what catch-all means, which industries use it most, how to detect it, how to score risk, and when to send or suppress.
A catch-all mail server (also called accept-all) is configured to return SMTP 250 OK - “message accepted” - for any address sent to it, regardless of whether the specific inbox exists. Most organisations configure this to avoid losing email sent to typos or old aliases.
This means SMTP probing tells you nothing about whether the specific inbox exists - the server accepts everything. The email may land in a central catchall inbox, get forwarded to an alias, or be silently discarded.
| Industry | Catch-all prevalence | Why they use it | Send recommendation |
|---|---|---|---|
| Law firms | Very high (60-80%) | Avoid missing client communication to old partner addresses | Send with monitoring - very high value contacts |
| Financial services (banks, insurance) | High (50-70%) | Regulatory: must not lose any inbound email | Send score > 0.6 - high deliverability once message is accepted |
| Government / public sector | High (40-60%) | Central routing for public email infrastructure | Send with monitoring |
| Large enterprises (Fortune 500) | Medium (30-50%) | Centralised Exchange / Microsoft 365 routing | Generally worth sending - high organisational legitimacy |
| Healthcare | Medium (25-40%) | Patient communication routing, clinic aliases | Send with score > 0.7 - compliance context matters |
| SMB / startups | Low (10-20%) | Usually run Google Workspace or Outlook with normal rejection | Standard verify - most will resolve as valid/invalid |
| E-commerce | Low (5-15%) | Consumer domains rarely use catch-all | Standard verify + disposable check |
BounceZero probes the MX server for the domain. If the server accepts a randomly-generated test address, the domain is flagged as catch-all. This is done without sending any real email.
When a domain is catch-all, BounceZero runs secondary signals: domain age (older = more trustworthy), MX provider reputation, email format (first.last vs generic shorthand), company size from enrichment data, and historical deliverability patterns for similar domains. These combine into a score (0.0-1.0).
The API returns result: “catch-all” - distinct from valid, invalid, and unknown - so your sending platform can route catch-all addresses to a separate cohort or apply a different send policy.
A score above 0.7 on a catch-all address means the secondary signals are strongly positive (old domain, recognised provider, structured email format, large organisation). Below 0.4 means multiple risk flags - suppress.
A catch-all domain accepts every incoming email regardless of whether the inbox exists. The server returns 250 OK for any address - even fake ones - making standard SMTP verification unable to confirm individual inbox existence. Common at law firms, banks, enterprises, and government organisations.
Standard SMTP can’t confirm individual inbox existence on catch-all domains. BounceZero uses risk scoring from secondary signals: domain age, MX provider reputation, email format, company size, and historical data. A score above 0.7 means strong positive signals; below 0.4 means suppress.
Yes, with monitoring. Catch-all doesn’t mean invalid - many high-value B2B targets (law firms, banks, Fortune 500) run catch-all servers. Include catch-all addresses with score > 0.6, monitor the cohort’s bounce rate separately, and suppress the cohort if bounces exceed 3%.
BounceZero returns result: “catch-all” plus a deliverability score for every catch-all domain. 100 free credits on signup - no credit card.
Ayoub built BounceZero's 5-stage validation pipeline, its dedicated BGP-announced IP infrastructure, and the Patroni HA PostgreSQL cluster behind every verification. Previously built high-volume email delivery infrastructure. Trained at 1337 Benguerir (École 42 network, 2019). Open-source: bgp_analyzer.
Deep-dive guides on how email verification and inbox placement work
272,446-domain census: DMARC gap, provider divide, catch-all rates
10.2M verifications: 12.3% of addresses are dead, and where they hide
826K re-verifications: only 19% of valid addresses survive 90 days
True catch-all is 1.4% - most of what looks catch-all is unprobeable providers
info@ bounces 4.5x more than personal addresses - measured, not guessed
The 3x invalid-rate gap that vanishes when you control for domain size
Explore other topics