What Is a Catch All Email? How Catch-All Addresses Work, Why Verifiers Can't Confirm Them and How to Email Them Safely

A catch all email is an address on a domain whose mail server accepts every message, whatever comes before the @. The server never says whether a mailbox exists, so a verifier returns "catch-all" instead of valid or invalid. Spona's own checks put 14.25% of 40,000 addresses in that bucket.

This guide takes the B2B sender's side. It shows what the server does during a verification check, why companies set it up that way, and what each verifier calls the result. It also shows what happened when one customer sent 1,200 emails to catch-all addresses. Setting up a catch-all mailbox gets one answer, in the FAQ.

Get thousands of leads in 4 minutes.

Stop stitching tools together.
Start with verified sales data, delivered in minutes.

SCALE SALES NOW

No contracts · No setup · No onboarding

Catch all email meaning: one inbox that accepts every address

Two groups use the term, and they mean two different things.

To a mail administrator, a catch-all is a mailbox. Proton describes it as the option to "receive all mail sent to their domain", including mail to addresses nobody set up. Namecheap's wording: any email sent to your domain "that is not yet set up to be an email account or an email alias" lands there.

Real mailboxes keep their own mail. Proton notes that mail to an existing address "won't be delivered to the catch-all address".

To a sender, a catch-all is a verification result. NeverBounce puts it in one line: accept-all "is a setting on the recipient's mail server, not a verdict on the individual address". The address you checked could be a real person, a typo or someone who left two years ago. The server told you nothing either way.

The spellings vary: catchall email, catch-all email, accept-all email. Verifiers also say "accept all" and hosts say "wildcard". They all describe the same server behavior.

One misreading causes most of the damage. People hear catch-all and think "dead address". The status says the domain accepts everything. It says nothing about whether the person is still there.

How a catch all domain answers a verifier's SMTP check

A verifier checks an address by starting a delivery and stopping before any message goes out. It connects to the domain's mail server, names a recipient and reads the reply. RFC 5321, the SMTP standard, defines those replies. When the server accepts the recipient, it "returns a "250 OK" reply". When the recipient is "known not to be a deliverable address", it answers 550.

On a normal domain, that reply settles the question. A 250 means the mailbox exists. A 550 means it does not.

A catch-all domain answers 250 to everything. The verifier cannot tell a real mailbox from a made-up one, so it runs a second probe.

Hunter's method is to ask the server whether it will accept mail for an address "that doesn't exist for sure". A yes marks the whole domain as accept-all. Every address on that domain then inherits the label.

The standard saw this coming: a server "MUST NOT return a 250 code" to a verification command unless it has actually verified the address. When it cannot, code 252 "SHOULD be returned" instead. That rule covers the VRFY command. A catch-all server answers at the recipient stage, where a 250 means it will take the message, not that anyone reads the mailbox.

One more clause matters later. A server that accepted a message and then cannot deliver it "MUST construct an "undeliverable mail" notification" and send it back. The yes at the door can turn into a no after the send.

Why companies set up catch-all email addresses

The help pages of the hosts that offer the feature give two reasons. A mail migration can add a third case.

Typos. one.com's example is a sender who types "daivd@domain.com" instead of david@. Without a catch-all, the server refuses the message. With one, it lands in a mailbox someone checks.

Departed staff. Google Workspace lets an admin route messages sent to "non-existent or incorrect email addresses" into a catch-all mailbox. The routing option carries the label "All inactive and unrecognized accounts". A leaver's inbound mail keeps reaching the company. This is an admin's routing rule, not a default: a Google-hosted domain is not catch-all unless someone switched it on.

Migrations. Microsoft 365 takes the opposite stance: its Directory-Based Edge Blocking lets a tenant "reject messages for invalid recipients at the service network perimeter". The reply is "550 5.4.1 Recipient address rejected: Access denied". Microsoft tells admins to leave a domain as "Internal relay" only until the directory holds every valid recipient. Until then, the edge may accept unknown recipients, and a verifier's probe can read that as catch-all.

Spam is the price. one.com's warning to anyone switching the feature on: "most emails that you catch will be spam".

Catch all email verification: what each verifier returns

In email verification, "catch-all" means the verifier found a mail server that accepts any recipient, so it could not test your address.

Every verifier hits the same wall. ZeroBounce says catch-all emails "are impossible to validate without emailing them" and waiting to see if they bounce. MailerCheck agrees: "there is no way to know if they are valid or invalid". What differs is the label, and what the vendor does next.

The labels come from each vendor's own help pages and product pages. Prices for the deeper checks sit in the email list cleaning guide, not here.

Unknown is a different result. NeverBounce defines it as the server not giving "a definitive answer in time", often because of greylisting or a security gateway. A catch-all server answered; an unknown server did not.

Recheck an unknown tomorrow and it may resolve. Recheck a catch-all and you get another 250.

How common catch-all emails are: Spona's 40,000 B2B checks

Spona checked 10,000 unique candidate addresses in each of four countries before any send. The figures are Spona data, and the share that came back catch-all ran from 12% in the UK to 16% in Germany.

The share counts against every unique candidate address checked. An address is pass, catch-all or other rejected, never two of them. Spona has not measured role or vertical splits, and these four countries are the only ones it has measured. Across all four countries, about one checked address in seven came back with no verdict.

Other published shares describe other populations. ZeroBounce found that "more than 9%" of all the emails it checked were catch-all, out of more than 11 billion addresses it processed. MailerCheck's figure is 8.6% of everything it has verified, but per customer list the median jumps to 15.25%. Hunter counts domains rather than addresses: "38% of email domains" in a sample of 2,572 addresses were accept-all.

None of those lines up with Spona's table. Each counts a different thing on a different list. What they share is the direction: a sizeable minority of whatever list you check.

Are catch-all emails risky for cold email? What one customer saw

Yes, and the risk is measurable. Spona's live benchmark sets the baseline and excludes catch-all addresses by rule: "Hard bounce is permanent delivery failures divided by attempted sends to the verified subset, excluding catch-all addresses". On 20,000 such sends, the hard-bounce rate was 1.525%.

One customer sent to catch-all addresses anyway and reported the outcome. Over about three months, that customer's 1,200 sends produced 86 hard bounces, which Spona logged as a separate cohort. That is 7.17%. Reports like this keep their own send denominator and never enter the benchmark.

Side by side, the cohort's rate is about 4.7 times the benchmark rate.

Two cautions travel with that gap. The 7.17% comes from one customer's 1,200 sends. It is not an industry rate, and it does not predict yours. The two cohorts also differ in more than the catch-all label, so the gap compares outcomes; it does not measure a cause.

Hunter ran its own test: one campaign to 100 accept-all and 100 valid addresses. The result: "The bounce rate was 27%" for the accept-all group and 1% for the control. Different list, different sender, same direction.

The mechanism is the clause from RFC 5321 above. A catch-all server accepts every message at the door, then tries to deliver it inside. When no mailbox matches, it has to send the undeliverable notice. ZeroBounce's warning follows from that: "Non-existent catch-all email addresses will end up bouncing" and hurting your sender reputation.

Hunter lists the three possible outcomes for a message to an accept-all domain: "delivered, redirected to a catch-all inbox, or bounce later". You learn which one only after the send.

Where the line sits: Twilio writes that a bounce rate "above 2%" means it is time to act, and that healthy programs run below 1%. A catch-all segment that bounces like that cohort, dropped into a verified campaign, pulls the whole campaign's rate toward that line.

How to verify catch-all emails beyond the SMTP check

No tool can confirm a mailbox behind a catch-all server. The server will not say, and nothing else can speak for it. What the better tools do is estimate, three ways.

Confidence scores. Hunter attaches a score to its Accept all results, built on "the number and freshness of the sources" where it found the address. Its guidance: treat a score of "85-100%" as valid, while the address stays slightly more likely to bounce. A score is a probability drawn from web evidence, not a server reply.

Deeper probes. MillionVerifier says a deeper ping converts "up to 40%" of catch-all emails into Valid or Invalid, and the rest stay Risky. That is the vendor's figure for its own method, on its own lists. Treat every recovery rate the same way until you have tested it on yours.

Evidence outside the mail server. A name that fits the company's address pattern, a profile at that employer, a recent mention on the company site. Each one raises the odds that the mailbox exists. The B2B data validation guide covers that pipeline, and none of it changes the server's answer.

The one test that works is the one that costs you. Sending a message and watching for a bounce is the only way, as ZeroBounce says. Yet no bounce may just mean a catch-all inbox, which Hunter says is unlikely to be read. Hunter notes the method raises "ethical concerns", since you are spamming other businesses to find out, and every bounce lands on your domain's record.

How to email a catch-all address safely: six steps

1. Keep a separate segment. Catch-all addresses never sit in the same list as verified ones. The data hygiene checklist keeps them in their own segment at every send.
2. Cap the share. Hunter's guidance is to limit accept-all addresses to a small share of your campaigns, 2% to 5% of sends. At that share, a segment bouncing like the customer cohort would add at most a few tenths of a point.
3. Rank by evidence. Send first to the addresses with a high confidence score, a matching name pattern or a recent public mention. Leave the bare guesses for last, or skip them.
4. Send in small batches and watch. NeverBounce's advice is to send "in small batches" and monitor which ones bounce back. If your provider requires a bounce rate "below 4%", NeverBounce says to send selectively rather than drop them.
5. Stop on the first bounce from a domain. A hard bounce from a catch-all domain tells you its sorting failed for that name. Suppress the address at once, and pause the rest of that domain until you have a better name.
6. Use the identity on another channel. A catch-all status says nothing about the person, so the name, company and role may still be useful. A call or a LinkedIn message does not bounce. A second contact at the company can help, but on the same domain their address is catch-all too.

How Spona handles catch-all emails, and where it falls short

Spona finds leads from a chat description of your ideal customer, verifies every address and delivers a scored list in about 4 minutes. Catch-all addresses go through the same SMTP check as everything else. What happens next follows six rules.

Where it fits. You pay per lead, and a catch-all address never counts toward the verified-email count. An email-only Standard Search lead costs 3 to 7 credits. At the plans' credit prices that is $0.024 to $0.07.

Each new search session also has a one-time cost of 1,000 credits.

Rule 3 is the useful one for catch-all records. Spona keeps the person's record, and enrichment can add a mobile number for 35 credits. That is $0.28 to $0.35, and the conversation moves to the phone. Every search starts with a free sample, and the Free plan carries 3,000 one-time credits.

Where it falls short. Spona cannot confirm a catch-all mailbox either; its catch-all export carries no mailbox or bounce-rate claim, by design. It sells no resolver and no confidence score for those records, which Hunter and MillionVerifier do.

The country table covers the US, the UK, Germany and France only, with no role or vertical split. The 1,200-send cohort is one customer's report, logged because that customer sent it in. Spona does not send your email, so it sees catch-all bounces only when a customer reports them.

Get thousands of leads in 4 minutes.

Stop stitching tools together.
Start with verified sales data, delivered in minutes.

SCALE SALES NOW

No contracts · No setup · No onboarding

Catch all email FAQ

How do I set up a catch-all email address?

In your mail host's admin settings, not in a mail client. Proton allows it on "any Proton paid plan" under Settings, All settings, Organization, Domain names, then Set catch-all. Google Workspace uses a routing rule for "All inactive and unrecognized accounts" that "can take up to 24 hours" to apply. Microsoft 365 works the other way round, rejecting unknown recipients at the edge.

What is a catch-all domain?

A catch-all domain is one whose mail server accepts mail for any address, including addresses that do not exist. Verifiers detect it by probing a made-up address: a 250 for that marks the domain. Every address at the domain then carries the catch-all status, so the status describes the domain, not the person.

Is a catch-all email an invalid email?

No. Invalid means the server refused the address with a 550. Catch-all means the server accepted it along with everything else, so the address may well belong to a real person. In Spona's checks, pass, catch-all and other rejected are separate categories, and each address falls into only one.

Do catch-all emails bounce?

Some do, after the server has accepted them: it takes the message, finds no matching mailbox and sends back an undeliverable notice. One customer's 1,200 catch-all sends came back with 86 hard bounces. In Hunter's test, 100 accept-all addresses had a 27% bounce rate. Neither figure predicts your list.

Should I remove catch-all emails from my list?

Not automatically. Hunter's position is that accept-all addresses "shouldn't be discarded automatically", and that nobody should treat them as fully valid either. Keep them in their own segment, email the best-evidenced ones in small batches, and move the rest to the phone or LinkedIn. MailerCheck describes a common grace period of 3 to 6 months without opens or clicks before removal.