Should I use a catch-all email address on my domain?

What you are actually turning on

Without a catch-all, your domain accepts mail for the addresses you created and refuses everything else. That refusal is useful information: it tells the sender they have the wrong address, and it tells the rest of the internet that guessing at your domain does not work.

With a catch-all, your domain accepts everything. Not just plausible typos — every string anyone can put in front of your domain name.

A catch-all does not catch typos. It accepts everything, and typos are a small subset of everything.

Why spammers look for catch-all domains specifically

There is an established technique for finding valid addresses at a domain: try a long list of likely names and see which ones are refused. Refusals mean the address does not exist; acceptances mean it does. The result is a verified list, which is worth considerably more than a guessed one.

A domain with a catch-all refuses nothing, so every attempt appears to succeed. Two things follow. The whole guessed list is recorded as valid, and the domain itself is recorded as a catch-all — a property that makes it a permanently good target, because nothing sent to it will ever bounce.

The costs that are less obvious

You lose the ability to retire an address

Suppose sales@ was published in 2019 and now receives almost nothing but spam. Without a catch-all you delete it, and mail to it is refused cleanly. With a catch-all you cannot: deleting the address changes nothing, because the catch-all accepts it anyway. The only remedy is a rule that discards it, which means you are now silently destroying mail — including anything legitimate that still arrives.

You cannot tell a real address from a guess

When everything is accepted, the address a message was sent to stops carrying information. You can no longer see that a customer wrote to an address you never published, which is one of the clearest signals that a message is not what it claims to be.

Accepting and discarding harms your reputation

Refusing a message at the door is clean: the sender is told, and nothing is destroyed. Accepting a message and then discarding it is worse for everyone — legitimate senders get no bounce and assume delivery, and receiving systems track the difference between domains that refuse cleanly and domains that swallow everything.

It makes the inbox behind it unusable

In practice the catch-all destination becomes a folder nobody opens, because the ratio of noise to signal makes reading it pointless. At that point the feature has stopped catching typos entirely — the mail arrives somewhere, and nobody looks.

When a catch-all is genuinely the right answer

It is not always wrong, and the cases where it is right have a common shape: short-lived, or on a domain whose reputation does not matter.

• During a migration. For a few weeks after moving providers, a catch-all makes sure nothing is lost while you find out which addresses were actually in use. Turn it off when the list is complete.
• On a domain used only for receiving. A domain that never sends has no sending reputation to protect, which removes one of the larger costs.
• To discover what exists. Enable it briefly, log which addresses receive genuine mail, create those properly, then disable it. This is a diagnostic, not a configuration.
• Where addresses are deliberately disposable. Some people give a unique address to every service so they can see who leaked it. That is a real workflow, and it needs a catch-all by design.

What to do instead

1. 1

   Create the addresses you actually publish

   Usually fewer than ten. Under per-domain pricing there is no cost per address, so the only reason to avoid creating them is effort — and it is a few minutes once.

2. 2

   Add aliases for the two or three likely typos

   If your domain is easy to mistype, create the specific variants rather than accepting everything. inof@ costs nothing and does not open the door to the rest.

3. 3

   Keep addresses printed on old material alive

   An address on a business card from 2019 should keep working. Route it deliberately rather than relying on a catch-all to cover it by accident.

4. 4

   Let unknown addresses be refused

   A clean refusal tells a real sender they have the wrong address, and tells everyone else that guessing does not work here. That refusal is a feature.

5. 5

   Review once a year

   Retire addresses nobody uses. With no catch-all, retiring one actually retires it — which is the property you are buying.

Turning off a catch-all you already have

Switching it off without preparation is the one way to lose mail here, and it is easily avoided. The point is to find out what was genuinely arriving before you stop accepting it.

One caveat worth stating: if your domain has carried a catch-all for years, some of what you observe in that month will be mail to addresses that were never real — a supplier who mistyped an address once and has been writing to it ever since, and getting through. Those are worth an alias rather than a shrug, because the sender does not know anything is wrong and will not find out until the day you stop accepting it.