Catch-all email detection, step by step

Detecting a catch-all domain is a different job from checking a single mailbox. You are not asking "does this address exist?" — you are asking "does this server say yes to *everything*?" This page explains exactly how that test is performed, where it fails, and what to do with the result.

The core test: the random-address probe

A verifier opens an SMTP session with the domain's highest-priority MX host and issues two `RCPT TO` commands in the same conversation:

1. The real address you asked about, e.g. *sarah@company.com* 2. A random address that cannot plausibly exist, e.g. *x7f3q9zk2t@company.com*

The server's answers decide the verdict:

• Real accepted (250), random rejected (550) → the domain answers honestly. The real address is valid.
• Real accepted (250), random also accepted (250) → the server accepts everything. The domain is catch-all / accept-all and the mailbox cannot be confirmed.
• Real rejected (550) → invalid, regardless of the random probe.
• Timeout, 4xx, or greylisting → unknown; retry later rather than guessing.

That single extra `RCPT TO` is the whole detection mechanism. Everything else is about running it reliably.

Why detection is harder than it sounds

• Greylisting. Many servers temporarily defer the first attempt from an unknown IP with a 4xx code. If the verifier treats that as a rejection, a catch-all domain looks like a normal one. Correct handling is to retry after a delay from the same IP.
• Rate limiting and tarpitting. Providers throttle repeated `RCPT TO` commands from one connection. Probes must be spread across sending IPs and sessions.
• Delayed rejection. Microsoft 365 and some hosted Exchange setups accept at the SMTP door and bounce afterwards, which is functionally catch-all behaviour even when the domain is not configured that way.
• Reputation-sensitive MX hosts. A verifier probing from blocklisted IPs gets a 550 for everything and mislabels valid domains as invalid. IP quality directly affects accuracy.
• Anti-spam gateways. Proofpoint, Mimecast and Barracuda front-ends often accept all recipients and filter downstream, so they report as catch-all by design.

Signals that support the SMTP result

Good detection combines the probe with cheaper checks that run first:

• MX record lookup — no MX or a null MX means nothing is deliverable, so no probe is needed.
• Known-provider fingerprinting — Gmail, Outlook and Yahoo consumer domains are never catch-all, so a 250 there is trustworthy.
• Gateway fingerprinting — recognising a security gateway in the MX hostname explains an accept-all answer.
• Domain age and disposable-domain lists — a disposable domain is a separate flag from catch-all.
• Historical bounce data — a domain that previously accepted then bounced is treated as accept-all.

What the result means for your list

A catch-all verdict is not a failure of the tool; it is the honest answer. Treat those addresses as a distinct segment:

• Never mix catch-all addresses into a reputation-critical send from a new or warming domain.
• Keep catch-all volume under roughly 20% of any single campaign.
• Prefer addresses matching a confirmed corporate pattern (first.last@) over guessed permutations.
• Promote a catch-all address to "safe" once it engages — an open or click proves a human received it.
• Suppress permanently on the first hard bounce.

Any vendor that reports 100% valid with zero catch-all results on a real B2B list is either mislabelling accept-all domains as valid or not running the probe at all. Roughly 10–20% catch-all is normal for B2B data.

Doing it yourself vs using a verifier

You can reproduce the probe manually with `telnet` or `swaks` against a domain's MX host, but at any volume you will hit rate limits, greylisting and IP reputation problems within minutes. Production detection needs a pool of warmed IPs, retry logic for 4xx codes, per-provider concurrency limits and a result cache.

VeriMailX runs the full probe on every check and returns `catch_all` as its own status rather than folding it into "valid". Test a single address with the free email verifier, check a whole domain in the domain directory, or automate it with the email verification API.

Related reading

Start with what a catch-all address is for the conceptual background, then SMTP verification for the underlying protocol conversation.