A catch-all email address is a mailbox configured to accept mail sent to any address at a domain, whether or not that mailbox exists. Verification tools return it as accept-all rather than valid or invalid, because the receiving server gives the same answer to every address.
That is the problem. A catch-all result is not a pass. It is the server declining to tell you anything.
The short version
- A catch-all server answers “yes” to every address, so
ceo@domain.comandasdkjh@domain.comboth come back accepted. - No verifier can see past it. The information does not exist at the SMTP layer.
- On a list that is 30% catch-all, the segment only has to be 7% invalid to push total bounces past 2%.
- Isolate catch-all addresses into their own small send and measure before committing the main campaign.
Why businesses run catch-all servers
Catch-all is a deliberate configuration, not a fault. A company turns it on so that mail to a mistyped address still arrives, so that john.smith@ keeps working after John leaves, and so that nobody has to create a real mailbox for every alias printed on a business card.
The trade-off is accepted knowingly on their side. A catch-all domain also receives every spam message aimed at every invented address, which is why many of them sit behind aggressive filtering. From the outside, none of this is visible.
Why an SMTP check cannot see past it
Verification works by opening an SMTP conversation with the recipient’s mail server and asking whether an address is deliverable, without actually delivering anything. On a normal server the answer is useful: a 250 for a real mailbox, a 550 for one that does not exist.
A catch-all server returns 250 for everything. The check completes successfully and tells you nothing, which is why a result labelled accept-all, catch-all or unknown is honest rather than a tool failing. Treating it as a fifth category instead of a soft yes is the distinction that matters.
| Result | What the server said | What it means | Action |
|---|---|---|---|
| Valid | 250 for this specific address | The mailbox exists | Safe to send |
| Invalid | 550 or similar permanent rejection | The mailbox does not exist | Remove |
| Disposable | Address sits on a known throwaway domain | Temporary inbox, often abandoned | Remove |
| Role-based | Valid, but an alias such as info@ | Shared inbox, often unmonitored | Send with care, expect low engagement |
| Catch-all | 250 for every address tried | Nothing about this mailbox | Segment and test |
Some tools attach a confidence score to catch-all results using pattern matching or historical sending data. That can be better than nothing, but it is an estimate, and it is worth knowing which of the two you are looking at. The scoring differences between providers are part of what our Reoon vs ZeroBounce comparison looks at.
The bounce math on a catch-all list
The reason this matters is arithmetic rather than theory. Catch-all addresses that turn out to be dead return a 5xx on send, and those are hard bounces against your domain.
| List of 10,000, 30% catch-all | Invalid inside the catch-all segment | Hard bounces | Total bounce rate |
|---|---|---|---|
| 3,000 catch-all addresses | 5% | 150 | 1.5% |
| 3,000 catch-all addresses | 10% | 300 | 3.0% |
| 3,000 catch-all addresses | 20% | 600 | 6.0% |
| 3,000 catch-all addresses | 40% | 1,200 | 12.0% |
These are worked figures, not measurements — the real invalid share inside a catch-all segment is exactly what cannot be known in advance. What the table shows is how little margin there is. The conventional 2% ceiling is crossed once about 7% of the segment is dead, and 7% is not a high number for business addresses that have been sitting in a database for a year. The consequences are covered in our piece on hard bounces versus soft bounces.
How to decide whether to send
Deleting every catch-all address is wasteful, because a large share of legitimate business domains run one. Sending to them blind is reckless. The workable answer sits between the two.
Split them out and treat the first send as a measurement. A few hundred addresses, sent separately from the main campaign, produces a real bounce figure for that segment within a day or two. If it comes back under 2%, the rest of the segment is probably fine. If it comes back at 8%, you have learned that cheaply.
Two other filters help before that test. Addresses following an obvious corporate pattern such as first.last@ are more likely to be real than generic guesses. And addresses collected more than a year ago should be treated as a separate, older cohort regardless of catch-all status. Where verification fits into ongoing list hygiene is covered in our Reoon Email Verifier review.
Volume matters too. If the send pushes you over 5,000 messages a day to Gmail, the bulk sender requirements apply, and a 0.3% complaint ceiling sits alongside whatever your bounce rate does.
Frequently asked questions
Is a catch-all email address valid?
Unknown, which is the whole point. A catch-all server accepts mail for every address at the domain, so an SMTP check returns the same answer for a real mailbox and an invented one. Validity can only be established by sending.
Should I send cold emails to catch-all addresses?
Only in a separate, small send. Isolating them protects your main campaign from an unknown bounce rate. Send a few hundred first, measure what comes back, and decide from the actual figure rather than an assumption.
Can a verifier tell me how many catch-all addresses are real?
No. No verifier can, because the information does not exist at the SMTP layer. Some tools apply pattern checks or historical data to guess, but a guess labelled as a score is still a guess, not a confirmed mailbox.
Do catch-all addresses hurt sender reputation?
Only when they bounce. A catch-all address that reaches a real person behaves like any other. The risk is that you cannot tell in advance which ones will return a 5xx, so an unsegmented send carries an unknown bounce rate.
Why do companies use catch-all email?
Convenience, mostly. It stops mail to a mistyped address being lost, keeps old addresses working after staff leave, and avoids creating a mailbox for every alias. The side effect is that the domain also accepts every spam message.
Bottom line
Catch-all is the one verification result that is not a verdict, so treat it as a separate segment rather than a soft yes. A few hundred test sends will tell you more than any confidence score.
Related reading
- Reoon Email Verifier Review 2026 — how the credit structure works and what the tool reports on accept-all domains.
- Reoon vs ZeroBounce — the two handle catch-all scoring differently, which changes what you can act on.
- Hard Bounce vs Soft Bounce — what a dead catch-all address actually costs when it returns a 5xx.
