A catch-all email address is a rule on a domain you own that accepts mail addressed to any name at that domain and delivers it all into one mailbox. Set it up on example.com and shop@example.com, newsletter@example.com and asdf@example.com all arrive, even though none of those mailboxes exists. Whether you should use one depends almost entirely on how much spam you are willing to absorb in exchange for never having to create an address again: it is an excellent tool for a domain nobody has heard of, and a steadily worsening one for a domain that has been in a few leaks.
How it actually works
Normally a mail server knows exactly which recipients exist on a domain. When mail arrives for a name that is not on the list, the server rejects it during the SMTP conversation with a 550 5.1.1 "user unknown" response and the sending server gives up. Nothing is stored and nothing is filtered, because the message was never accepted in the first place.
A catch-all removes that list check. The server is told that any local part — the bit before the @ — is valid, and that mail for names you have not explicitly defined should be delivered to one nominated mailbox. In cPanel this setting is called the Default Address. In Google Workspace it lives under routing, as a rule that forwards unrecognised recipients to a chosen user. Microsoft 365 has no plain catch-all switch at all; administrators approximate one by setting the domain to internal relay and adding a transport rule, which is enough extra work that a lot of people give up and define aliases instead.
Explicitly defined addresses still take priority. If billing@example.com is a real mailbox, mail for it goes there, and only the leftovers fall through to the catch-all.
What a catch-all is genuinely good for
The appealing part is that you stop planning. You are on a signup form, you type the company's name as the local part — acme@yourdomain.com — and that address works immediately, with no dashboard visit, no provider, and no limit on how many you create. For someone who owns a domain and signs up for a lot of things, that is a real reduction in friction compared with generating an alias each time.
It makes leaks self-documenting
Because each address names the company you gave it to, the moment one of them starts receiving unrelated marketing you know exactly which signup is responsible. Not "something leaked my address" but "the hardware shop I bought a drill from in March leaked it". That changes what you can do about it: you can stop giving that company anything, you can tell other people, and you can block that one address rather than tightening filters across your whole mailbox. Our piece on why spam suddenly increases covers the usual causes; a catch-all turns that guessing game into a lookup.
No third party holds the mapping
With a hosted alias service, somebody else keeps a record that alias X belongs to real address Y, and that record is worth stealing. A catch-all on your own domain has no mapping to steal, because there is nothing to map — every address is simply your domain. You also keep the addresses if you change mail providers, which is the thing people most regret giving up when they rely on a provider's alias domain. The trade-offs between those two approaches are laid out in our comparison of aliases and disposable inboxes.
It is convenient for testing
Developers reach for catch-alls because a test suite can invent recipients freely. signup-test-0194@yourdomain.com needs no provisioning, so a registration flow can be exercised repeatedly without creating mailboxes or polluting a colleague's inbox. It also catches typos of real addresses, which is quietly useful for a small business: mail sent to jon@ when the owner is john@ still lands somewhere a human will read it.
The cost, and why it grows
The rejection you gave up was doing real work. Spammers routinely run dictionary attacks against domains: they try info@, admin@, sales@, hello@, contact@, first names, and lists of common local parts harvested elsewhere. Against a normal domain, almost all of that is refused at the door and never costs you anything. Against a catch-all, every single guess is a successful delivery. Your spam filter now has to make a judgement call on mail that previously did not exist.
This is why a catch-all feels fine for a year and then does not. A brand-new domain nobody has sampled receives very little; a domain that has appeared in a few breach dumps, or whose WHOIS or website advertises addresses, gets enumerated continuously. The volume only moves in one direction, and it arrives in the one mailbox you nominated.
Two smaller problems are worth knowing about. Accepting mail and then bouncing it — which some setups do when the catch-all mailbox is full or a forwarding rule fails — sends those bounces to forged sender addresses, which is both useless to you and bad for your domain's reputation. And a catch-all accepts misdirected mail intended for someone else: if your domain resembles a company's, you will eventually read invoices and personal correspondence that were never meant for you, and being able to read it does not make keeping it a good idea.
Turning it off is harder than turning it on
Once you have used thirty ad-hoc addresses across thirty accounts, those addresses are your logins and your password-reset paths. Disabling the catch-all stops all thirty working at once, and you will not remember which ones mattered until something fails to arrive. Anyone running a catch-all for a while should keep a list of the addresses actually tied to accounts, or convert each one into a defined alias as it becomes load-bearing.
Safer versions of the same idea
You rarely have to choose between a wide-open domain and manual admin for every address.
- Put the catch-all on a subdomain. Run it on
in.yourdomain.comand leave the main domain rejecting unknown recipients. Dictionary attacks aim at the domain people know; the subdomain is only in circulation where you put it. - Require a prefix. Accept only addresses matching a pattern you chose — anything starting
s-, say — and reject the rest. You keep unlimited addresses while refusing every guess that does not know your convention. - Use an alias service on your own domain. Paid tiers of the main alias providers let you point your domain at them, which gives you per-address on/off switches and replies, without a third party owning the domain.
- Switch it on temporarily. If you need a catch-all for a migration or a week of testing, enable it, finish, and turn it off before it is in anyone's list.
When a catch-all is not the tool
All of this assumes you own a domain, pay for it, renew it, and are willing to be your own postmaster when delivery breaks. If you do not, a catch-all is not a small step — it is a domain registration, DNS records, a mail provider and an ongoing responsibility, and the mail you receive is only as reliable as your attention to all four.
It is also the wrong shape for the most common reason people want a throwaway address. If a site wants an email address purely to send one confirmation link, you do not need that address to exist tomorrow, and you certainly do not need it pointed at a mailbox you own. A disposable inbox is better suited: the address already exists, the message appears in front of you, and when it expires there is nothing left to maintain, disable or regret. Keep the catch-all — or better, defined aliases on it — for the companies you actually intend to hear from again, and let the one-off signups land somewhere that disappears on its own.
If you do run one and want to know what is hitting it, the headers tell you more than the subject lines do; our guide to reading email headers explains how to see which server really sent a message and whether it passed authentication, which is the quickest way to sort genuine misdirected mail from enumeration noise.