What Is a Catch-All Email Address? Meaning and Risks

A catch-all email address is a mailbox that receives mail sent to any address at a domain, including addresses nobody set up, as long as the address has no mailbox or alias of its own. If example.com has a catch-all, mail to shop@example.com, r8kq2@example.com, or jnae@example.com (a typo for jane@example.com) is accepted and delivered to that one mailbox instead of bouncing back to the sender. CatchNone reads that mailbox on iPhone, iPad, and Mac and shows which address each message reached, including addresses you never set up.

It goes by other names too, and it’s often written as one word, catchall. Fastmail calls it a catch-all or wildcard alias, cPanel the Default Address, and iCloud+ Allow All Incoming Messages on iPhone (Allow all incoming emails on iCloud.com). Google Workspace calls it catch-all routing, and Cloudflare Email Routing has a Catch-all rule. Verification tools call a domain that behaves this way “accept-all.” To switch one on, see how to set up a catch-all email on any host.

Which catch-all do you mean?

The term turns up in two places, and they need different answers.

• You own a domain, or you’re thinking about one. Catch-all is a setting at your mail host. People turn it on so misaddressed mail isn’t lost, or so they can make up a new address for every signup. Most of this page is for you.
• A list-cleaning tool marked an address “catch-all” or “accept-all.” That’s a verdict about the recipient’s domain, not about the address. Skip to why verifiers flag catch-all domains.

How a catch-all email address works

Owning a domain doesn’t give you a mailbox by itself. Its MX record has to point at a mail host or a forwarding service, and sending servers look up that record to find where to deliver. RFC 5321, the SMTP standard, says that when a domain has MX records, senders must use them.

The sender’s server then names each recipient in turn. A normal server answers 250 OK for a mailbox it has and 550 (“no such user”) for one it doesn’t, and the sender gets a bounce. A catch-all answers yes for every name before the @:

Sender's server
 1. Looks up MX for example.com (DNS)
 2. Connects to that server (SMTP)
 3. RCPT TO:<r8kq2@example.com>
    normal:    250 if it exists, 550 if not
    catch-all: 250 for any address
 4. Sends the message
Your mail host
 5. No mailbox r8kq2, so the catch-all
    rule delivers it to your mailbox

An address you’ve set up still wins: Fastmail, for example, delivers mail for a specific alias to that alias instead of the catch-all. And a catch-all only covers the part before the @. A typo in the domain, such as jane@example.net when you meant example.com, goes to a different domain or nowhere, so no catch-all of yours can catch it.

Catch-all vs wildcard email address, alias, and plus address

“Wildcard email address” usually means the same thing as a catch-all. Fastmail’s help calls it a “catch-all alias (also known as a wildcard alias),” and you create it as *@example.com. Two other uses of “wildcard” are different things:

• A DNS wildcard (RFC 4592), such as a *.example.com record, answers for subdomain names that have no records of their own, such as anything.example.com. It has nothing to do with the part before the @, and a catch-all doesn’t need one.
• A pattern in a mail rule or filter only sorts mail that has already arrived. A filter in a Gmail account can’t make a domain accept addresses its mail server would refuse.

Forwarding is a way of delivering, not a kind of address. A catch-all can deliver into a mailbox at the same host, as iCloud+ and Fastmail do, or send everything on to an inbox elsewhere, as Cloudflare Email Routing does.

The privacy use: make up an address at every signup

This is why many people turn catch-all on. You don’t set anything up in advance. At a shop’s checkout you type bookshop@example.com, or something random like r8kq2@example.com, and the shop’s mail arrives in your mailbox. If that address later gets spam, or mail from a company you never gave it to, you know which signup it came from.

Two habits make it work better:

• Use random addresses rather than site names. Anyone who knows your domain can guess amazon@example.com, so spam to it proves less about who leaked it. Bitwarden’s username generator has a “Catch-all email” type that creates a random address at your domain. More options are in the guide to generating a random email address that really works.
• Keep a record of which address you gave to which site, for example in that site’s password manager entry.

One address per site also makes breach checks more telling. Have I Been Pwned lets you search a whole domain once you prove you control it, free for domains with up to 10 breached addresses as of September 2026. Your record then tells you which site each breached address was given to.

Without a domain of your own, CatchNone’s @catchnone.com addresses (Premium) need no domain, DNS, or mailbox to set up. The service assigns each one at random on a shared domain, so no name of yours ties them together. Some services instead give you a subdomain that works like a catch-all. 33mail’s site still describes making up bbqtrading@you.33mail.com on the spot, and SimpleLogin (on its paid Premium plan) and addy.io offer subdomains with catch-all. The subdomain ties your addresses together just as your own domain would.

The downsides of a catch-all

Guessed addresses and more spam

On a normal domain, mail to an address that doesn’t exist bounces. On a catch-all, every guess is delivered. The addy.io FAQ says spammers and bots “often try random email addresses” such as contact@ or admin@. cPanel cautions that a forwarded default address “may receive a large amount of spam” if spammers target your domain. Providers describe the risk without putting a number on it. Guessing is only one route; the others are in how spammers get email addresses.

Typos that never bounce

Without a catch-all, someone who mistypes your address gets a bounce and can try again; Apple and Proton both document that bounce when catch-all is off. With one, jnae@example.com is delivered and the sender never learns of the mistake.

On a domain only you use, that’s often what you want. It causes trouble in two cases. On a shared domain, cPanel notes, the catch-all can receive mistyped mail meant for existing addresses, so the wrong person may read it. And the sender keeps using the wrong address, so if you later block it or turn the catch-all off, their mail stops reaching you without warning.

Your domain links your addresses together

Privacy Guides warns: “If you are the only person using your custom domain, your actions can be easily tracked across websites simply by looking at the domain name in the email address and ignoring everything before the @ symbol.” Your own domain does make you easier to connect across sites than a domain many people share, and if the domain is your name, it identifies you outright. A catch-all still tells you who leaked an address, but it doesn’t stop anyone from seeing that the addresses belong together.

Your addresses last only as long as the domain

Every address you made up depends on your domain registration. If it lapses, whoever registers the domain next can receive mail sent to all of them, password-reset links included. Turn on auto-renew and secure your registrar account.

Can you turn off one address on a catch-all domain?

Yes, on most hosts, but not through the catch-all setting itself: you add a separate rule or alias for each address you want to stop, and whether the sender gets a bounce depends on the host. Fastmail’s Disable option and a Google Workspace Reject message setting bounce the mail, a cPanel forwarder can refuse it with an error, Cloudflare Email Routing’s Drop action deletes it silently, and iCloud+ returns mail sent to an address you created and then deleted, according to Apple (iCloud+ allows three active addresses per domain, so you may need an open slot first).

That’s fine for a few leaked addresses; for dozens it becomes a list to maintain, and Cloudflare caps routing rules at 200 per domain (both limits as of September 2026). Whatever the host, send a test message from another account afterward. Host-by-host steps are in how to stop one address on a catch-all and, for iCloud, the iCloud+ Custom Email Domain guide.

On their paid plans (as of September 2026), alias services such as addy.io and SimpleLogin can run a catch-all on your own domain, creating each alias the first time it gets mail, and then let you switch any one of them off.

Catch-all or an alias service?

Privacy Guides prefers a dedicated aliasing service because aliases can be turned on and off one at a time and replies go out from the alias. Most hosts can block single addresses too, with one rule per address, as described above. Sending depends on the host: Fastmail lets you type any From address at a catch-all domain, while Cloudflare Email Routing doesn’t support sending or replying from your domain. The linkability point stands, though.

A catch-all on your own domain suits you if you want addresses that outlive any one service; a shared alias domain suits you if you want signups that can’t be matched up by domain. CatchNone works with both: on your own domain it reads your catch-all mailbox directly, and with Premium its @catchnone.com addresses sit on a shared domain, where switching one off makes senders get a bounce. Either way, each message is badged with the address it reached. It’s receive-only by design, so that mail stays in its own app and you reply from your usual account. For costs and the full comparison, see whether your own email domain is worth it.

For list owners: why verifiers flag catch-all domains

Verification tools check an address by talking to the recipient’s mail server over SMTP and stopping before any message is sent. If the server answers 250 for every address, the check proves nothing, because real and made-up addresses look the same. Once a server has accepted a message, a later failure comes back as a separate bounce, or the message is dropped quietly: Kickbox says such a server “may silently discard the message or send a bounce message after the fact.”

How tools label the result:

• Kickbox: “Accept-All,” classed as Risky, with the advice “Use caution when sending to risky addresses.”
• NeverBounce: “Accept all (Unverifiable),” adding that catch-all “is a setting on the recipient’s mail server, not a verdict on the individual address — these emails are often valid.”
• Hunter: the status accept_all, with a score estimating how likely the address is to be valid.

It’s common. ZeroBounce reports that more than 9% of the addresses it processed in 2025 came back catch-all, and MailerCheck gives 8.6% for the addresses it has verified. ZeroBounce also says Microsoft 365’s inbound routing can make probes look catch-all when no catch-all mailbox exists, while Microsoft documents that its Authoritative domains reject unknown recipients.

Should you send to catch-all addresses?

A catch-all result means “unknown,” not “invalid.” Keep catch-all addresses that came through a confirmed signup or have clicked a link in your mail, send to the rest in small batches, and remove any that bounce.

Sorting catch-all mail by address

Sort by the address each message was sent to, but mail sent to you by Bcc doesn’t show your address in To or Cc (RFC 5322), and list mail is often addressed to the list. A Delivered-To header, described in the experimental RFC 9228, helps where your host adds it. Rules and searches for each host are in reading catch-all mail address by address.

Where CatchNone fits

CatchNone’s Bring your own domain path is built to read a catch-all mailbox. It connects from your device straight to the mailbox your catch-all delivers to, read-only over IMAP (TLS, port 993 by default) or JMAP, so that mail never passes through CatchNone’s servers, and it never changes your DNS. Every message is badged with the address it reached, so a leaked or sold address shows up, and Activity points out mail on an unused alias and first-time senders. Mail to an address you never created shows up under that address with a gray badge; create an alias with that address later, through Customize, and its earlier mail takes the alias’s name and color. The Free plan’s cap of 10 counts aliases you create, not the addresses whose mail shows up, and Lite and Premium have no limit on aliases there. Download CatchNone, available for iPhone, iPad, and Mac.

CatchNone is receive-only, so catch-all mail stays in its own app and you reply from your usual account. Each check reads the newest 100 inbox messages from the last 30 days, so if your catch-all draws a lot of spam, a dedicated catch-all mailbox keeps alias mail from being pushed out. CatchNone doesn’t filter spam or block addresses on your domain; your host’s rules do that. Without a domain, CatchNone offers random @catchnone.com addresses with Premium, with no domain, DNS, or mailbox to set up: switching one off makes senders get a bounce, and each message is kept for 30 days after it arrives.

FAQ

Are catch-all emails safe?

A catch-all doesn’t make any single message more dangerous; phishing is the same whatever address it reaches. What it adds is exposure: guessed addresses get delivered, typos reach you instead of bouncing, and on a domain only you use, your addresses can be linked. For a sender, a catch-all address isn’t dangerous, just unverifiable: some will bounce after the fact, which is why Kickbox classes them as Risky.

Can Microsoft 365 have a catch-all address?

No. Exchange Online has no catch-all setting: when all of a domain’s mailboxes are in Microsoft 365, it rejects mail to unknown addresses with 550 5.4.1, and the workarounds that circulate aren’t official guidance. The setup guide explains why Microsoft 365 has no catch-all and what to do instead.

Can a Gmail account have a catch-all?

Not for an @gmail.com address, because each one is a single account, though plus addresses and dotted versions of your own address still reach you. With a domain you own, Google Workspace has catch-all routing, or a forwarder such as Cloudflare Email Routing can send every address to a regular Gmail inbox, as described in using Gmail with a custom domain through Cloudflare.

Should I turn on catch-all for my domain?

Turn it on if you want to make up addresses on the spot or don’t want to lose misaddressed mail, and you’re willing to block leaked addresses one by one. Leave it off if you’d rather create each address on purpose. There are middle grounds: Proton recommends pointing the catch-all at a dedicated address so it doesn’t clutter your inbox, and addy.io lets you set a pattern so only matching addresses are created automatically. If you turn it on, the setup guide has the steps for each host, and these email providers for a custom domain offer a catch-all if yours doesn’t.