What it is
Normally a mail server checks the recipient during the SMTP conversation: when the sender says RCPT TO:<priya@acme.co> the server looks the mailbox up and answers 250 OK if it exists or 550 No such user if it does not. A catch-all server skips the lookup and answers 250 to everything. Mail to unknown addresses is delivered to a designated mailbox, quietly discarded, or bounced later from inside the system — after it was accepted.
Why companies do it
Three reasons, in order of how often I see them. Google Workspace and Microsoft 365 both offer catch-all routing as a checkbox, and someone ticked it years ago so that mail to former employees and typos would land in a shared inbox instead of bouncing. Anti-harvesting: a server that says 550 to bad addresses is telling attackers which ones are good, so some security-conscious tenants deliberately say yes to everything. And legacy: an on-premises Exchange or a small hosting panel that was never configured otherwise.
Why it matters for senders
Verification tools work by asking the server the RCPT TO question. On a catch-all domain the answer carries no information, so the tool reports catch-all or unknown rather than valid or invalid. Roughly one company domain in five behaves this way, and they cluster on Google Workspace. The addresses may be perfectly real — plenty of good prospects sit behind catch-alls — but a list of guessed addresses at a catch-all domain will bounce at whatever rate the guesses are wrong, and you will not find out until after the send.
What to do with them
Treat catch-all as a third state, not a pass. If the address came from evidence — a signature, a reply, a vendor's activity data — send normally. If it came from a pattern guess, send to a handful first, watch the bounce rate on that domain, and stop the moment it climbs. Keep catch-all addresses in a separate segment so one bad domain cannot drag the whole campaign over the 2% line. And do not count on a later bounce to tell you: some catch-all systems accept, discard, and never bounce at all.
Detecting it
Ask the server about an address that certainly does not exist — a random string at the domain. If it says 250, the domain is catch-all. Good verifiers do this automatically and report it as a status. The one-address verifier below does; the bulk permutator's verification sample does too, and marks each row.
Check yours
These run free in your browser or from the edge. Nothing is stored.
Common questions
Is catch-all the same as a valid address?
No. It means the server accepted the address without checking. The mailbox may or may not exist. Treat it as unverified, not as good.
Can I detect a catch-all myself?
Yes: verify a random, certainly-nonexistent address at the domain. If the server accepts it, every address at that domain will be accepted regardless.
Do catch-all addresses bounce?
Sometimes, later, from inside the recipient's system — after the SMTP acceptance. Some tenants discard unknown mail silently. Either way you cannot rely on a bounce to tell you the address was wrong.
Should I remove catch-all addresses from my list?
Not automatically. Segment them, send in small numbers, and let the bounce rate on each domain decide. Addresses that came from evidence rather than guessing are usually fine.
Related concepts
If this is the thing going wrong
The pages explain it. If you would rather it was simply fixed, that is the work I do.