What is a catch-all mailbox?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
A catch-all mailbox is a domain configuration that accepts email sent to any address at your domain, even if that specific address doesn't exist. Someone emails typo@yourdomain.com and you don't have that mailbox set up? With catch-all enabled, the email lands somewhere anyway instead of bouncing.
The idea sounds useful. Typo-proof your domain, never miss an important email because someone got your address wrong. In practice, catch-all mailboxes attract massive amounts of spam and can quietly damage your domain's reputation.
Here's why: spammers test thousands of random addresses at every domain they find (admin@, sales@, info@, test@, made-up strings). If your domain accepts mail to non-existent addresses, it confirms your domain is active and accepting mail. You've just volunteered to receive spam for every possible address variation anyone can think of.
The reputation problem is subtler. Mailbox providers like Gmail and Outlook track how domains handle mail. If your catch-all is filling up with spam and nobody's reading it, that looks like your domain accepts junk mail. Over time, that can hurt deliverability for your legitimate addresses.
Legitimate uses exist, but they're rare. If you're a small company with 3-5 people and you want one person to triage everything, a catch-all feeding into a single monitored inbox can work. Some companies use it during a migration to make sure nothing falls through the cracks while they're moving mailboxes. But as a long-term configuration, it's almost always more trouble than it's worth.
Better approach: set up the specific addresses you actually need (hello@, support@, billing@) and let everything else bounce. If someone emails the wrong address, they'll get a bounce notification and can correct it. If you're worried about typos in your own address, create common misspelling aliases that forward to the real mailbox. Configuration lives in your DNS MX records or your email hosting control panel (Google Workspace, Microsoft 365, Zoho Mail). If you inherited a catch-all setup and you're drowning in spam, turn it off. The spam will stop almost immediately.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
