Catch-All Email: What It Is and How to Verify One
A catch-all inbox says yes to every address you throw at it — real or made up. That's why the usual SMTP check can't tell you anything about it, and why you need a different set of tricks.
What a catch-all email actually is
Catch-all is a setting at the domain level, not on an individual mailbox. A domain like acme.com is either catch-all or it isn't — there's no such thing as a catch-all address on a domain that isn't itself configured that way.
When a domain is catch-all, its mail server is set up to accept mail for any address at that domain, instead of checking each one against a real mailbox list before deciding whether to accept it. Run an SMTP check against a completely made-up address at a catch-all domain — definitely-not-real@acme.com — and the server still answers 250, mailbox accepted. It isn't lying exactly; it's just deferring the question of whether anyone actually reads that mail to a step your validation check never gets to see.
That's not always a bad thing for the business running it. A lot of small companies choose catch-all on purpose, precisely so a customer's typo — jhon@ instead of john@ — still reaches someone instead of bouncing. Yahoo Mail is catch-all by nature for the same reason, across every domain it hosts. For you, on the receiving end of validation, that same setting means the one signal SMTP normally gives you — accepted or rejected — stops being informative.
How to tell a domain is catch-all in the first place
This part is easy, and it's exactly how validators detect it: probe the domain with an address that obviously doesn't exist — a random string nobody would ever register. If the server accepts that too, you've confirmed the domain is catch-all, and every "valid" result from a normal SMTP check on that domain should be treated as unverified, not confirmed.
The hard part is what comes next. There's no SMTP-level trick that separates a real catch-all address from a fake one — by design, the server gives the same answer to both. Confirming one takes finding actual evidence that a person reads it.
Watch it: the Google and Microsoft login trick
The fastest of the methods below is checking whether an address is registered as a Google or Microsoft account — both will tell you directly whether the account exists. Here's what that looks like in practice, on two real catch-all addresses:
4 ways to check a catch-all address
None of these get you to 100% certainty — that's the nature of catch-all. But stacked together, they turn "no idea" into "very likely real" for most addresses worth the effort.
Search for the address itself
Search the exact address in quotes, or search the company name plus "pdf" or "contact". If the address shows up in an official document — a price sheet, a press release, a staff directory — that's real evidence someone reads it.
Try the Google or Microsoft sign-up trick
Check the domain's MX record first. If it's Google Workspace, open an incognito window, go to the Google sign-in page, and enter the address. Google will tell you outright whether that account exists. Microsoft 365 domains work the same way through the Microsoft login page. It costs nothing and it's a direct answer, not a guess.
Check where else the address is registered
Look for the address on GitHub, LinkedIn, a professional directory, or any service that requires signing up with a real inbox. An address that's actively used to log into other services is very unlikely to be dead.
Send to it directly (last resort)
The only 100%-certain test is sending a real email and watching for a bounce. It works, but it burns a send from your domain on an address you're not sure about — and a pattern of bounces is exactly what damages your sender reputation. Save this for addresses you can't confirm any other way, and never for a whole list.
Match the login trick to the right MX
The sign-in method only works if you check it against the right provider. Look up the domain's MX record before you start — it tells you whether mail for that domain is actually routed to Google Workspace, Microsoft 365, or somewhere else entirely, so you know which login page to try. Testing a Microsoft 365 address on the Google sign-in page just wastes a click.
This same principle extends past Google and Microsoft: any provider that requires an account sign-up with a real address can be used the same way, once you know which one actually hosts the domain's mail.
Frequently Asked Questions
We flag catch-all domains for you
MatchKraft's validation API already tells you when a domain is catch-all instead of quietly marking it "valid" — and a dedicated catch-all verifier, built on real-world evidence instead of SMTP alone, is coming next. Free plan: 100 validations per month.
Try it for free