Email verification

Catch-all email verification

A catch-all domain accepts mail for any address at it, real or not, so no mailbox check can prove that one particular address exists. Here is how verification spots those domains, why their addresses are risky rather than invalid, and what to do with them.

Request early access Bulk email verifier

What a catch-all domain is

A mail server normally refuses an address it has no mailbox for, and that refusal is what a verifier listens for. A catch-all (or accept-all) server answers yes to every address at the domain and sorts the mail out later: into one shared inbox, into the right mailbox, or into nothing. Companies set it up so a misspelled name still reaches someone, or because their mail gateway accepts first and filters afterwards.

How verification spots it

Next to the address you asked about, the check asks the same server about an address at the same domain that cannot exist, a long random string. If the server accepts that one too, it would accept anything: the domain is accept-all, and a yes for your address proves nothing. The conversation ends before any message is sent, for both addresses.

# mx.pinecrest-law.example

RCPT TO:<m.chen@pinecrest-law.example> 250 accepted

RCPT TO:<x7q2kz9w1v@pinecrest-law.example> 250 accepted

# both accepted: the domain accepts every address

risky · reason accept_all · mailbox not confirmable

Risky, not invalid

Most addresses on accept-all domains belong to real people at real companies; the check simply cannot tell which ones. Marking them invalid would throw good contacts away, and marking them deliverable would hide the ones that bounce later. So they come back as risky with the reason accept-all, and the decision stays with you.

What to do with them

Keep addresses with a history: someone who clicked or replied recently is real, whatever the server says.
Send to the rest in a smaller segment first and watch bounces before mailing them at full volume.
Ask new signups to confirm their address (double opt-in): a click on the link proves the mailbox exists.
Remove anything that hard-bounces at once, so it never costs you twice.

Why not send a test email to find out?

Because a test message is still mail to someone who did not ask for it. If the address is dead it bounces, if it is a trap it counts against the sending domain, and either way the reputation that pays for it is real. EmailSecOps never sends mail to the addresses it checks; the verification ends at the question.

Questions about catch-all addresses

What is a catch-all email address?+

An address on a domain whose mail server accepts mail for any address at all, whether a mailbox exists or not. The server decides afterwards what to do with the message, so accepting it says nothing about whether a person will read it.

Is accept-all the same as catch-all?+

Yes. Accept-all and catch-all name the same server behaviour: every address at the domain is accepted when the message is offered. Verification results use accept-all as the reason.

Can you verify an email address on a catch-all domain?+

Not with certainty. The server says yes to every address, so the usual mailbox check has nothing to tell apart. What proves the address is engagement: a reply, a click, or a confirmed double opt-in.

Should I send email to catch-all addresses?+

Usually yes, with care: most belong to real people. Keep the ones with recent engagement, send to the rest in a smaller batch first, and remove whatever bounces.

Verify lists with accept-all flagged, not guessed.

The bulk email verifier and API report accept-all as its own reason. In early access.

Request early access →

Early access · Nothing is sent to the addresses you check · Privacy