A catch-all address accepts mail for any local part at a domain. If the domain is example.com and the catch-all is set, mail to sales@, billing@ or x7k2q9@ all land in the same mailbox. The idea is simple, and the trade-offs are worth understanding before you turn it on.
How it works
Normally a mail server checks each recipient against its list of mailboxes and aliases during the SMTP conversation. An unknown recipient gets a permanent rejection, a 5xx reply such as 550. A catch-all changes that check: any recipient at the domain is accepted and routed to a designated mailbox. The sending server sees success, and the message is delivered.
Advantages
- Per-service addresses without setup. You can give each service its own address, such as
shop-example@example.com, without creating it in advance. - Traceability. When a service you gave an address to sells or leaks its customer list, the address shows which list leaked. That makes the source easier to identify and block.
- Fewer lost messages. A sender who mistypes a local part still reaches you. For a single person or a small team, a missed message can be costly.
- Simple onboarding. A new project or colleague can use a name without an administrator creating it first.
Disadvantages
- Spam to guessed names. Harvesting and dictionary attacks try common local parts such as
info,adminandsupport. A catch-all receives every guess, so the volume arriving in one mailbox can rise sharply. - Backscatter. If a server accepts a message and later decides it cannot deliver it or it is unwanted, the server may send a bounce to the forged sender address. That bounce is spam with an innocent-looking origin. Rejecting unknown recipients during the SMTP session avoids this.
- Filtering burden. The inbox fills with mail you did not expect, and the address alone does not tell you whether the sender is legitimate.
- A single leak exposes the domain. If one address on a domain is found in a leak, every other name on the domain will also accept mail, so the domain becomes easier to target.
Safer ways to get the same benefit
Most of the advantage comes from having distinct addresses, not from accepting everything. Named aliases give you a separate address per service, and only the aliases you create work, so unknown names are rejected. Plus-addressing gives tags on one mailbox: you+shop@example.com delivers to you@example.com, and a Sieve rule can file the tagged mail into its own folder. ITProMail supports plus-addressing. The aliases guide and the subaddressing guide describe both approaches.
When a catch-all makes sense
- A domain used by one person who creates many single-use addresses and does not want any rejections.
- A domain where you control the list of senders and filter aggressively.
- A migration period, when old addresses still receive mail and you want nothing lost while you map them to new ones.
In most other cases, leave the catch-all off and create explicit aliases as needed. If you do use one, add a Sieve filter that files unknown local parts into a separate folder, and review that folder regularly for legitimate mail that was sent to a misspelled address. The Sieve examples include patterns for sorting mail by recipient.
Setting expectations
A catch-all does not reduce spam. It moves spam from rejected to accepted, and it usually increases the accepted volume. Plan for filtering. On ITProMail, catch-all is part of the Shadow plan, which also includes unlimited aliases. The pricing page lists the differences between plans.