What a catch-all domain is, and why no tool can verify one

If you have ever run a list through a verifier and got back a column of results marked risky, accept-all, or catch-all, this is what that means, and why it is the one category no verification tool can resolve for you.

What the server is doing

Verifying an address is a short conversation. The verifier looks up the MX record for the domain, connects to the mail server it points at, and works through a few SMTP commands. The important one is RCPT TO, which asks the server whether it would accept mail for a specific mailbox.

On an ordinary domain the server answers honestly. If the mailbox exists you get a 250. If it does not, you get a 550 and a rejection message. The verifier closes the connection without sending anything, and you have your answer.

A catch-all domain is configured to accept mail for every address at that domain, whether or not the mailbox exists. Ask about ceo@example.com and you get a 250. Ask about qzxplkj@example.com and you get a 250 for that too.

The server is not being evasive. It is doing what it was configured to do.

Why anyone configures it that way

Catch-all is a reasonable setting, and it is common at small and mid-sized companies. Three usual reasons:

1. Nothing gets lost to a typo. Someone writes jon.smith@ instead of john.smith@ on a business card, and the mail still arrives somewhere a human will look.
2. Departed staff stay reachable. Mail to a former employee lands in a general inbox instead of bouncing back to a customer.
3. Aliases are cheap. Sales, billing, and per-vendor addresses work without anyone creating them first.

The side effect is that the domain can no longer tell anyone which of its addresses are real, including you.

What this means for your list

An address on a catch-all domain is genuinely unknown. It might be a real person who replies tomorrow. It might be a pattern guess that goes nowhere. The mail server cannot distinguish them and neither can any tool, ours included.

This is the point where verification tools differ, and it is worth knowing which kind you are using.

Some count catch-all addresses as valid. That makes the accuracy number on the marketing page look excellent and hands you a list with unbounded bounce risk buried inside it. Some return them as unknown and charge you a credit for the privilege. Some, including us, put them in their own group and label them for what they are.

A tool that tells you a catch-all address is definitely deliverable is guessing and not saying so.

How much of a list is usually catch-all

It varies with the audience. A list of enterprise contacts at large companies tends to have very few, because large organisations run tighter mail configurations. A list of small businesses, agencies, or startups can run much higher, sometimes a quarter or more of the total.

If you send mostly to small companies, expect a meaningful catch-all group on every list, permanently. It is not a sign that something went wrong.

What to do with them

Three approaches, depending on how much risk your domain can carry.

Send to them, separately. Put the catch-all group on its own sending domain or subdomain, away from your primary one. If the bounce rate in that group turns out to be bad, the damage is contained somewhere you can afford it.

Warm up before you commit. Send a small sample first, a few hundred addresses, and measure what comes back. The real bounce rate for a given catch-all domain is stable enough that a sample tells you what the rest will do.

Skip them when the domain is fragile. If you are sending from a new domain, or one that has already taken a reputation hit, leave the catch-alls out entirely until you have headroom again. They are the least certain records on the list and the most expensive to be wrong about.

What does help

The catch-all verdict is the ceiling of what SMTP can tell you, but other signals still apply to those addresses:

• The domain still has to have valid MX records, and some do not.
• The domain can still be a known disposable provider.
• The local part can still be a role address like info@ or support@, which behaves differently from a personal mailbox regardless of catch-all status.
• The address pattern can still be checked against other addresses you have confirmed at the same company.

None of that confirms the mailbox. All of it narrows the risk, and the combination is usually enough to decide whether a particular catch-all group is worth sending to.

The short version

A catch-all domain accepts everything, so 250 OK from one of them means the domain answered, not that the mailbox exists. Any verifier that reports those as valid is optimising its own accuracy claim at the expense of your bounce rate. Keep them in a separate group, sample before you commit, and keep them off a domain you cannot afford to damage.