Why a domain would accept everything
Catch-all is a deliberate setting, usually in the mail server or hosting control panel. Small businesses enable it so that mail sent to a mistyped or retired address still lands somewhere, typically a shared inbox. Some organizations use it for privacy, so an outsider cannot discover which addresses are real by probing. Others inherited it from a default configuration and never turned it off.
Google Workspace, Microsoft 365, and most self-hosted servers all support catch-all routing, so it appears across every size of company and every mail provider.
Accepting a message is not the same as having a mailbox
During an SMTP session the server answers RCPT TO with 250 if it will take responsibility for the address. On a normal domain that means a mailbox exists. On a catch-all domain it only means the server will try to route the message later. If the address does not map to a real mailbox, the message may be delivered to a shared inbox, silently discarded, or bounced minutes afterward by a downstream filter.
Verifiers detect catch-all by probing a second address with a random local part that cannot exist. If that address is also accepted, the domain is catch-all and the original 250 reply carries no information about the mailbox.
> RCPT TO:<jane@example.com>
< 250 2.1.5 Ok
> RCPT TO:<x9q2m7v4k1@example.com>
< 250 2.1.5 OkHow verification services report it
An honest result for a catch-all address is neither deliverable nor undeliverable. VeriDock returns status risky with reason catch_all, sets checks.catch_all to true, and lowers the score to reflect the uncertainty. The syntax, domain, and MX checks still passed, so the domain is real and accepts mail; only the mailbox itself is unconfirmed.
A catch-all result tells you the domain is healthy and the mailbox is unproven. Both halves matter.
Practical guidance for handling catch-all results
Do not treat catch-all as invalid. Many legitimate business contacts sit on catch-all domains, and rejecting them at signup loses real customers. Do treat them differently from confirmed deliverable addresses when the cost of a bounce is high.
- At signup, accept the address and rely on your confirmation email as the real test.
- For outreach, send to catch-all addresses in a separate, smaller batch and watch the bounce rate.
- Use other signals: a plausible first.last pattern scores better than a random string on the same domain.
- Keep the domain and provider fields from the response so you can group catch-all contacts by organization.
Key takeaways
0/4Try it on a real address
Run syntax, DNS, MX, disposable, and role checks on any address. No signup needed.
Enter an address and press Check.
Runs real syntax, DNS and mail-server checks.
This demo checks syntax, domain, mail server, disposable and role-address rules. Sign up free for live mailbox checks.
Frequently asked questions
Verify addresses with one API call.
250 free checks every month, recurring. Unknown results are never billed.