Catch-all domain

How a catch-all gets detected

During SMTP verification the checker asks the mail server whether a specific mailbox exists (RCPT TO:<jane.doe@company.com>). A normal server answers 250 for real mailboxes and 550 5.1.1 user unknown for the rest. A catch-all answers 250 for everything.

The check for that is a probe: ask about a mailbox that cannot exist, such as a long random string at the same domain. If the server accepts the nonsense address, it will accept every address, so its answer for jane.doe@ carries no information.

Why a "yes" from a catch-all is not a yes

The server accepted the message at the door. What happens next is up to the company. The mail may be delivered to a shared inbox, routed to a person, silently dropped, or bounced hours later by a filter behind the front door. You learn which only after you send, and a late bounce still counts against your sender reputation.

A security gateway sitting in front of the real mail system can produce the same behaviour, accepting at the door whatever is behind it. A verifier that reports a catch-all address as "valid" is overselling what it knows.

What to do with them

• Do not treat them as verified. The honest status is accepts everything, not confirmed.
• Prefer a second signal. A pattern the company is known to use, or an address seen on a public page, makes a catch-all address a reasonable bet. A guess at the format does not.
• Send in small batches and watch the bounce rate on that segment before scaling it.
• Never pay full price for them. On FindLeadEmails a catch-all result is free and labelled as one; only a mailbox the server actually confirmed is charged.

Run any domain through the catch-all checker to see which kind of server you are dealing with before you build a list around it.