Catch All Email: Setup, Risks, Cold Outreach

What does catch-all mean in email?

Catch-all is a setting on the mail server, and it applies to the whole domain. Without it, the receiving server checks the recipient during the SMTP conversation. If no mailbox called asdf@yourdomain.com exists, the server answers the RCPT TO command with a permanent 'user unknown' error and the sender gets a bounce. With catch-all switched on, the server accepts any local part at the domain and delivers the message to one mailbox you've chosen. Other names for it are accept-all address, wildcard alias or, in cPanel, Default Address. Two things don't change. Mail for mailboxes that do exist still goes to those mailboxes, because catch-all only handles addresses nobody has claimed. And catch-all only works at the domain your MX records point to. If the domain has no working MX record, there's nothing to catch.

How do I set up a catch-all email on my domain?

Where the switch sits depends on your mail host, not your registrar. The table lists the places named in each provider's own documentation. Check the current admin console before you rely on a menu path, because consoles get reorganised.

Mail host	Where the catch-all lives	What to watch
Google Workspace	Admin console, Apps, Google Workspace, Gmail, Default routing: add a rule for unrecognised recipients and change the envelope recipient to your chosen mailbox (Google admin help, 'Get misaddressed email in a catch-all mailbox')	The rule applies per organisational unit. Spam aimed at made-up addresses reaches the target mailbox too
Proton Mail (custom domain)	Domain settings in the Proton dashboard, where you mark one address as the catch-all (Proton support, 'catch-all')	Only works on domains you've added and verified in Proton
cPanel-based hosting	Email, Default Address: forward unrouted mail to an account, or discard it with an error	'Discard with error' is the setting that keeps normal bounce behaviour
Shared hosts with their own panel	Usually an advanced option when you create a mailbox, e.g. a catch-all checkbox	The label varies from host to host. Look for 'catch-all' or 'default address'
Microsoft Exchange Online	No single toggle. Set the accepted domain to Internal relay and add a mail flow rule that redirects unknown recipients (Microsoft Exchange Online documentation)	Internal relay turns off the directory check that rejects unknown recipients at the edge
Outlook.com consumer accounts	Not available. The Microsoft Q&A threads in the search results show users asking for it with no setting to point to	Use a custom domain on a host that supports catch-all

Should you set up a catch-all on your own sending domain?

It does have uses. You still get replies when someone mistypes a colleague's name, and you can hand out addresses like vendor-name@yourdomain.com without creating each one first. The cost is noise. Spammers run dictionary attacks against domains: they try large numbers of guessed local parts, and a catch-all accepts every one of them. There's a quieter cost too. Once your domain accepts everything, you lose the 'user unknown' bounce, which tells correspondents that they've got an address wrong.

• It works when the catch-all is a separate mailbox with its own filters, and you set up the real addresses you use (sales@, the DMARC report address) as proper mailboxes or aliases.
• It doesn't work when the catch-all lands in a salesperson's main inbox. Replies from prospects end up mixed in with dictionary spam and get missed.
• It doesn't change authentication. SPF, DKIM and DMARC cover mail you send, and a catch-all only touches mail you receive. Your outbound records stay exactly as they were.

Why am I getting hundreds of spam emails all of a sudden?

If the domain has a catch-all, two causes are common. The first is a dictionary attack: someone is guessing addresses at your domain, and the catch-all accepts every guess. The second is backscatter. A spammer puts your domain in the From address of their own campaign, the receiving servers bounce those messages, and the bounce notices go back to random addresses at your domain, which the catch-all collects. If the spam is mostly bounce notices for mail you never sent, it's backscatter. A DMARC record with an enforcing policy (p=quarantine or p=reject) tells receivers that check DMARC what to do with mail that fails alignment for your domain. The receiver still makes the call. Our DMARC rollout guide covers how to move from p=none to enforcement without blocking your own legitimate mail.

What does a catch-all domain mean for your prospect list?

Here the catch-all is on the other end of the email. Verification tools test an address by starting an SMTP conversation and watching how the server answers RCPT TO. A catch-all domain accepts every address, so the tool can't tell jane.doe@ from a made-up one, and it labels the address 'accept-all', 'catch-all' or 'unknown'. That label doesn't say the address is valid. Some catch-all servers accept the message during the SMTP conversation and then drop it quietly. Others send a bounce notice afterwards. A late bounce like that won't show up as a rejection at send time. It shows up later in your mailbox or in your sending provider's bounce log.

1. 1 Keep catch-all addresses separate in your list so you can see how they behave as a group.
2. 2 Prefer addresses from a source you can trace, such as the prospect's own signature or website, over addresses built from a name pattern.
3. 3 Send to the catch-all segment in small batches from a warmed domain, and read the bounce notices that come back.
4. 4 Take an address off the list after a hard bounce. Don't send a follow-up first.

How to read the Status and Diagnostic-Code fields in those late notices is explained in our guide to email bounce codes. Bounces count against the domain that sent the mail, which is why sender reputation is worth checking before you scale a segment you can't verify.

How EmailFlow OS handles catch-all prospects

EmailFlow OS is a personalised AI video email product. You record one video and upload it to EmailFlow OS, connect your own Brevo account and sending domain, and import your prospect list into EmailFlow OS. EmailFlow OS then makes a personalised version of that recording for each recipient, not each company, and sends each version from your own inbox, through your Brevo account and your domain. It never goes out through a shared platform sender. Because the list lives in EmailFlow OS and the mail goes out on your domain, any bounce from a guessed address at a catch-all domain shows up in your Brevo account and counts against your domain's reputation. Nobody else's. There's a second reason to clean these addresses: a version personalised for a person who doesn't exist goes to whoever reads the catch-all mailbox. The personalised video email setup on the EmailFlow OS home page describes that flow, and the deliverability checklist covers the list hygiene to do before importing.

Following up when the address is on a catch-all domain

Silence from a catch-all address can mean two things: the person isn't interested, or the person doesn't exist. Each of the points below covers one question about following up in that situation.

• Sales follow up email template: a short reply in the same thread, with one line pointing back to the first message, one new detail and one simple question. Before it goes out, check that no late bounce notice has come in for that address.
• Follow up sales email: send it as a reply to your first message, keeping the In-Reply-To header, so it threads under the original. If a bounce notice for the address arrived after the first send, cancel the follow-up instead.
• Sales email follow up templates: keep a no-reply variant, a variant for after a call and a breakup variant. For catch-all addresses, the breakup variant can also ask if someone else on the team is the right person.
• Sales follow up email: a message sent after an earlier touch got no answer. To a catch-all address, any follow-up is also a second test of whether the mailbox exists.
• Sales follow up email examples: 'Following up on the video I sent on Tuesday. Is onboarding still on your plate this quarter?' or 'If this belongs with someone else on your team, a name is all I need.'

Full wording for each situation is in our sales follow-up email templates.

Questions people ask

? Is a catch-all email the same as an alias?

No. An alias is one extra address you define, like billing@, that delivers to an existing mailbox. A catch-all is a rule for the whole domain that takes every address you haven't defined. An alias adds one address. A catch-all removes the server's 'user unknown' rejection for every address that doesn't exist.

? Can a catch-all email address bounce?

Yes, two ways. A catch-all server can accept a message during the SMTP conversation and then send a bounce notice later, for example when a filter or quota rejects it. And if the domain's MX records stop working, nothing is accepted at all. An accepted RCPT TO only means that the server took the message.

? How do I select all emails in my Gmail catch-all inbox at once?

Search for the messages, for example by the to: address, and tick the select checkbox above the list. Gmail selects only the visible page at first and then shows a link to select every conversation that matches the search. Click it, then archive, label or delete. A filter on the same search handles future messages automatically.

? Do email verifiers work on catch-all domains?

Only partly. A verifier can confirm the domain has working MX records and accepts mail. It can't confirm that a particular person's mailbox exists, because a catch-all server accepts every address the same way. That's why these addresses come back labelled accept-all or unknown rather than valid.