What a catch-all server does
Before a message is handed over, the sending mail server asks the receiving one a question: will you take mail for this address? A normal server answers yes for a mailbox that exists and no for one that does not. That "no" is what makes it possible to check an address without sending anything to it.
A catch-all server answers yes to everything. Ask it about anna@example.com and about x7k2q9p4@example.com and it accepts both. What happens to a message afterward is up to the company: it may land in a shared inbox, be dropped without a word, or bounce a few minutes later.
Why companies set it up
- So nothing is lost to a typo. Mail for
jonh@still reaches someone. - So outsiders cannot list the staff. A server that says no to unknown names tells anyone who asks which names are real.
- Because a security service stands in front. Many mail-security services take the message first and decide afterward whether to deliver or reject it.
- Because nobody changed the setting. Some hosting comes that way.
How a verifier detects it
By asking about an address that cannot exist: a long random name at the same domain. If the server accepts that too, its yes means nothing, and every address at the domain is marked risky instead of valid.
BounceTest asks this once per domain, and only after a real address has been accepted. A domain that refuses unknown addresses properly never sees a made-up one from us.
How common it is
More common than most people expect. In October 2026 we asked the mail servers of 68 well-known companies about an address that cannot exist, and about 20 of them accepted it. Of the six we sampled that use Google Workspace, five did. Among 75 large mailbox providers, 16 accepted it, among them Yahoo, AOL and several internet providers whose mail runs on the same systems.
So on a list of business contacts it is normal for a fifth or more of the addresses to come back as risky. That is the list being described truthfully, not the check failing.
Should you send to catch-all addresses?
It depends on where the address came from.
- The person gave it to you, recently. It is almost certainly real. Send.
- It is old, bought, scraped or guessed. This is where the bounces are. Leave it out, or test it carefully.
- You are not sure. Send to the risky ones separately, in a small batch, and watch what comes back. A common rule of thumb is to keep bounces under 2% of what you send.
Whatever you decide, remove an address the first time it comes back as a hard bounce.
A catch-all address is not an invalid address. Many belong to real people at companies that simply do not reveal which mailboxes exist.
Catch-all, invalid and unknown are different things
| Result | What the mail server said | What to do |
|---|---|---|
| Valid | Yes to this address, and no to a made-up one | Send |
| Invalid | No such mailbox | Remove |
| Risky | Yes to every address, real or not | Your call |
| Unknown | No answer, or "come back later" | Check again later |
For what is behind each of these answers, see how email verification works. For what a bounce costs you, see why emails bounce.