Catch-all emails, explained: what they are and how to verify them
Run any sizeable B2B list through a verifier and a chunk of it comes back neither valid nor invalid but 'catch-all' — usually somewhere between a tenth and a third of the list. It is the most misunderstood verdict in email verification, and the one where tools differ most in honesty.
A catch-all (or accept-all) domain is configured to accept mail for any address at that domain during the SMTP conversation. Ask its server whether sales@ exists and it says yes. Ask about a string of random characters and it also says yes. The standard existence check — connect, HELO, MAIL FROM, RCPT TO — stops producing information.
Why companies run catch-alls at all
Some do it deliberately: they never want to lose mail to a typo in the local part, or they route everything into one shared inbox and sort later. Some inherit it from security tooling — several mail gateways accept everything at the edge, then reject or discard invalid recipients after the conversation is over. And some simply misconfigured a wildcard years ago and nobody has touched it since.
The result is the same from the outside: RCPT TO succeeds for every address, and the bounce, if it comes, comes after delivery was already accepted.
What an honest verifier can still learn
Certainty is off the table, but signal is not. The right move is to probe the domain with a deliberately fabricated address and compare behaviour: if the fake is accepted identically to the real one, the domain is a true catch-all and the mailbox check is uninformative. From there, the remaining signals still work — does the domain have real MX records, which provider operates them, is it on a disposable list, does the local part look like a role account, what does the domain's reputation history say.
That is why Trumailo returns a risk-scored catch-all verdict rather than folding these addresses into 'valid'. Any tool that reports a catch-all address as simply valid is guessing with confidence it does not have.
Reading the verdict
- Valid — the server confirmed this specific mailbox exists. Send.
- Invalid — the server rejected the mailbox. Never send.
- Catch-all — the domain accepts everything; the mailbox itself is unknowable from the handshake. Score it, don't binarise it.
- A catch-all at a real company on a major provider, with a human-looking local part, is usually fine.
- A catch-all on a fresh domain with no web presence and a generic local part deserves suspicion.
A sending strategy for catch-alls
Do not delete them — on B2B lists you would be discarding a third of your genuinely reachable audience. Do not blast them either. Put them in their own segment, start them on low-volume, high-engagement sends from a warmed domain, and let engagement data resolve what the handshake could not: an open or a click proves the mailbox better than any probe ever will.
Watch the bounces on that segment closely and cut hard-bouncing domains immediately — with a catch-all, the bounce arrives after acceptance, so your feedback loop is the campaign itself.
The takeaway
Catch-all is not a verdict failure; it is the accurate description of a server that refuses to give the answer away. The difference between verifiers is whether they tell you that truthfully and hand you the surrounding signals — provider, reputation, disposability, role — or paper over it. Trumailo probes every domain's catch-all behaviour as one of its eight signals, and prices the whole thing at free while in beta, so you can test it against your own grey zone.