Catch-all addresses: why they attract spam and what to use instead

When you set up email for a domain, one option sounds like pure insurance: "accept mail sent to any address". A message to sales@, salez@, anything-at-all@ or a7x91q@ yourcompany.com all lands in one mailbox, and nothing is ever lost.

That is a catch-all (or wildcard) address. It feels safe, and many small teams switch it on. In practice it often causes more trouble than it prevents. This guide explains how it works, what goes wrong and what to do instead.

What a catch-all does#

Every email is addressed to a local part and a domain, such as support at yourcompany.com. Normally your mail provider has a list of valid addresses. If someone writes to an address that is not on the list, the provider rejects the message with "no such user" and the sender gets an error.

With a catch-all, the provider accepts everything for the domain and delivers it to one place. There is no longer such a thing as an unknown recipient.

Why people turn it on#

• Fear of missing mail. A customer mistypes suport@ and still gets through.
• Convenience. Use a different address for every service without creating each one.
• Legacy. Someone enabled it years ago and nobody turned it off.
• Simple setup. It avoids planning an address list.

These are reasonable motives. The problems arrive from the other side of the door.

What goes wrong#

Spam and harvesting#

Spammers guess addresses. They try info@, sales@, admin@ and long lists of common names, and with a catch-all every guess succeeds. There is no rejection to teach them which addresses are real. Your domain becomes a target, and the spam volume grows.

Worse, they also send to random strings. A mailbox that receives thousands of messages a day to addresses nobody has ever used is a sign of a catch-all being hammered.

The spam filter has a harder job#

Without a list of valid recipients, your filter cannot use "this address does not exist" as a signal. Everything is a candidate, and the real mail sits among the junk. Important messages can end up in spam, or you stop reading the inbox.

Sending problems#

A catch-all can damage your outgoing reputation too.

• If someone forges your domain, replies and bounces for addresses that never existed arrive at your catch-all.
• If you or your provider try to bounce messages later, after accepting them, you can create backscatter: bounce messages sent to forged sender addresses, which look like spam to the people who receive them.
• Mailing list operators and some filters treat domains that accept everything with suspicion.

For an overview of how mail from your domain is checked, see SPF, DKIM and DMARC in plain English and email spoofing explained.

Typos go to the wrong place without anyone knowing#

A catch-all hides mistakes. A customer writes to suport@ and the message lands in the catch-all among hundreds of junk messages. No one notices it for days, or ever. With no catch-all, the sender gets an immediate error and tries again.

Privacy and compliance#

A mailbox that receives mail for unlimited addresses collects personal data from strangers: spam, misdirected messages and sometimes sensitive information intended for others. You need to manage and secure that data like any other mailbox.