Is Microsoft 365 a Catch-All Domain? - BounceZero
It Depends - each M365 domain is configured independently

Is Microsoft 365 a Catch-All Domain?

15-25% of M365 business domains have catch-all enabled. You cannot tell from the MX record alone.

Microsoft 365 is a hosting platform - whether a given company's M365 domain is catch-all depends entirely on how their admin configured Exchange Online. All M365 domains share the same *.mail.protection.outlook.com MX records, so you can't tell from DNS alone. BounceZero probes each domain individually to detect catch-all before classifying addresses.

Backed by & listed on

G2
G2
Listed
aws
AWS
Activate
Google
for Startups
NVIDIA Inception Program
NVIDIA
Inception
MongoDB
Atlas
Gartner
Gartner
Peer Insights
Product Hunt
Featured
RapidAPI
Marketplace
Datadog
Startup Program
UK Ltd Co.
No. 17153835
G2
G2
Listed
aws
AWS
Activate
Google
for Startups
NVIDIA Inception Program
NVIDIA
Inception
MongoDB
Atlas
Gartner
Gartner
Peer Insights
Product Hunt
Featured
RapidAPI
Marketplace
Datadog
Startup Program
UK Ltd Co.
No. 17153835

Why Microsoft 365 Catch-All Is the #1 B2B Verification Problem

In B2B email marketing, the majority of addresses you're sending to are corporate - hosted on Microsoft 365 or Google Workspace. Consumer providers like Gmail and Yahoo are not catch-all. But corporate domains absolutely can be, and M365's Exchange Online makes it trivially easy for admins to configure catch-all.

The practical effect: your verification tool may return "verified" for a corporate address that doesn't actually exist as a real person's mailbox - it's being caught by the catch-all inbox and silently accepted. Your email lands in an unmanned mailbox, and you never know.

~20%
of M365 business domains have catch-all enabled
0
way to detect catch-all from MX records alone
100%
of M365 domains probed individually by BounceZero

How BounceZero Detects M365 Catch-All

  1. 1. Test probe - BounceZero sends a probe to a known-invalid address at the domain. If Exchange Online accepts it, the domain is catch-all.
  2. 2. Flag accept-all - the domain is marked catch-all and all addresses at it are flagged accordingly.
  3. 3. ML scoring - domain reputation, company signals, DMARC/DKIM configuration, and industry are used to estimate actual deliverability risk.

The result: instead of "verified" (wrong) or "unknown" (useless), you get an accurate risk classification for every M365 address.

Frequently Asked Questions

Is Microsoft 365 catch-all?

M365 is a platform - each domain is configured independently. ~15-25% of M365 business domains have catch-all enabled in Exchange Online. You cannot tell from the MX record alone.

How does BounceZero detect M365 catch-all?

By probing each domain with a known-invalid address. If Exchange Online returns 250 OK, the domain is catch-all. BounceZero then applies ML scoring instead of marking the address as verified.

Do large enterprises have M365 catch-all?

Less commonly than SMBs. Large enterprises with dedicated IT teams usually configure explicit mailboxes. SMBs and professional services firms are more likely to have catch-all enabled. BounceZero checks each domain regardless.

How much does it cost?

$3 per 1,000 verifications. 100 free credits on signup - no credit card required. Catch-all detection included on every domain.

Stop Treating M365 Catch-All as "Verified."

BounceZero detects catch-all per domain and scores with ML. 100 free credits to start.

Is [provider] a catch-all domain?

Per-provider answers - SMTP behaviour, detection methods, and how BounceZero handles each

Follow BounceZero