# Should you use a catch-all email address?

URL: https://iblockspam.com/blog/catch-all-email-address-spam
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> Why catch-all mailboxes attract spam and dictionary attacks, how to turn them off in Microsoft 365, Google Workspace and cPanel, and what to use instead.

## Short answer

Usually not. A catch-all accepts mail for every address at your domain, including ones that don't exist, so spammers' guessed and harvested addresses all land somewhere. It hides typos but multiplies spam, can generate backscatter, and stops your server from rejecting bad recipients. Use specific aliases, shared mailboxes or plus addressing instead, and reject unknown recipients.

A catch-all mailbox feels like a safety net: nobody's mail gets lost because of a typo or an old address. In practice it's mostly a spam magnet, and it quietly turns off one of the most useful checks a mail server can do. This guide explains what goes wrong, how to find and turn off catch-alls on the three most common platforms, and what to use instead.

## What is a catch-all email address?

A catch-all is a mailbox that receives everything sent to your domain for addresses that don't exist. cPanel calls it the **Default Address**, and its [documentation](https://docs.cpanel.net/cpanel/email/default-address/) describes it as catching mail sent to invalid addresses on a domain, including real addresses with typos. Google Workspace calls the equivalent a catch-all mailbox, set up through a routing rule. Some people also say "accept-all" for a domain whose server accepts every recipient during the SMTP session.

Without a catch-all, mail to an address that doesn't exist is rejected during delivery. The sending server sees a permanent error such as [550 5.1.1](https://iblockspam.com/smtp-errors/550-5-1-1) and tells the sender. With a catch-all, the same message is accepted and delivered to someone.

## Why do catch-all addresses attract so much spam?

### Every guess succeeds

Spammers don't only mail addresses they've collected. They also guess: common first names, roles like `accounts@` and `admin@`, and long lists of generated names. On a domain that rejects unknown recipients, almost all of those guesses fail at the `RCPT TO` step and cost you nothing. On a domain with a catch-all, every guess is delivered.

### It confirms your domain is live

Some senders probe before they send. [RFC 6647](https://www.rfc-editor.org/rfc/rfc6647.html#section-4.2) describes "automated programs that attempt to ascertain valid addresses to which to send spam (a 'directory harvesting' attack)" by starting an SMTP session and stopping after `RCPT TO`. A catch-all answers "yes" to every probe. [RFC 5321](https://www.rfc-editor.org/rfc/rfc5321.html#section-6.2) notes the wider problem: accepting a message "may trigger additional undesirable traffic by providing verification of the address."

### Old and leaked addresses never die

Addresses of former staff, old newsletter sign-ups and anything ever leaked in a breach keep receiving mail forever. Without a catch-all, they'd bounce and eventually drop off lists. With one, they never do.

cPanel's own documentation warns: "If spammers target your domain and you forward mail to a default address, that address may receive a large amount of spam."

## What other problems do catch-alls cause?

- **Backscatter.** If your server accepts mail for any address and then bounces it later instead of rejecting it during the session, you send bounces to forged senders. That's [backscatter](https://iblockspam.com/blog/backscatter-spam-bounce-messages), and it can get your server's IP listed. Check your sending IP with the [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker).
- **Forwarding damage.** A catch-all that forwards everything to a Gmail or Outlook.com address relays large amounts of spam from your server to theirs. That hurts your server's reputation, and [forwarding breaks SPF and often DMARC](https://iblockspam.com/blog/email-forwarding-breaks-spf-dmarc-arc) for legitimate mail too.
- **Lost filtering signal.** Rejecting unknown recipients is one of the cheapest checks a filter has. [How spam filters work](https://iblockspam.com/blog/how-spam-filters-work) explains why recipient validation happens early.
- **Sensitive misdirected mail.** Someone ends up reading mail that wasn't meant for them, sometimes including invoices, contracts or personal data.
- **A mailbox nobody reads.** Catch-all mailboxes fill up with spam, and the few real messages in them are often missed.

## How do you find and turn off a catch-all?

| Platform | Catch-all built in? | Where to check | How to turn it off |
|---|---|---|---|
| Microsoft 365 | No simple setting | Exchange admin center, **Mail flow > Accepted domains** (type) and **Mail flow > Rules** | Set the domain to **Authoritative** and remove the redirect rule |
| Google Workspace | Yes, as a routing rule | Admin console, **Apps > Google Workspace > Gmail > Routing** | **Disable** or **Delete** the catch-all routing setting |
| cPanel | Yes, the Default Address | cPanel, **Email > Default Address** | Choose to discard with an error message at SMTP time |

### Microsoft 365

Microsoft 365 has no single catch-all switch, and its default behavior is the opposite. When a domain's type is **Authoritative**, [Microsoft Learn](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains) says "Emails for unknown recipients are rejected." This is Directory-Based Edge Blocking (DBEB): if an address doesn't exist, "the service blocks the message before filtering even occurs," with a [550 5.4.1](https://iblockspam.com/smtp-errors/550-5-4-1) reply.

Catch-all setups in Microsoft 365 are workarounds. They usually switch the domain to **Internal relay** so unknown addresses aren't rejected at the edge, then add a mail flow rule that redirects mail for non-members to a catch-all mailbox. Microsoft's guidance on Internal relay is direct: "You should not select this option if all of the recipients for this domain are in Microsoft 365 or Office 365."

To check and undo it:

1. In the Exchange admin center, go to **Mail flow > Accepted domains** and open each domain.
2. If the type is **Internal relay** and you have no on-premises or other mail system for that domain, change it to **Authoritative** and confirm DBEB.
3. Go to **Mail flow > Rules** and look for rules that redirect messages to a single mailbox when the recipient isn't a member of a group. Disable them.
4. Send a test message to a made-up address at your domain from an outside account. You should get a 550 5.4.1 bounce.

Make sure every real recipient, including shared mailboxes, groups and contacts, exists in Microsoft 365 before step 2, or their mail will be rejected too.

### Google Workspace

In Google Workspace, a catch-all is a routing setting. Google's [catch-all article](https://knowledge.workspace.google.com/admin/gmail/advanced/get-misaddressed-email-in-a-catch-all-mailbox) builds it with the action **Change envelope recipient** and the account type option **All inactive and unrecognized accounts**.

1. In the Google Admin console, go to **Menu > Apps > Google Workspace > Gmail > Routing**. You need the Gmail Settings administrator privilege.
2. Under **Routing**, look for a setting that replaces the envelope recipient for inactive and unrecognized accounts. Also check **Default routing** for rules that act on unrecognized addresses.
3. Point at the setting and click **Disable** or **Delete**, then confirm.
4. Allow time to apply. Google says routing changes can take up to 24 hours, though they're usually faster.

If you need a safety net for a few important patterns, Google's routing setting has an optional **Envelope filter**, so you can limit catch-all handling to specific recipient patterns rather than every address.

### cPanel

cPanel's **Default Address** page sets what happens to mail for addresses that don't exist. The options include **Forward to Email Address** and **Discard the email while your server processes it by SMTP time with an error message**. Choose the second: it rejects mail for unknown addresses during the SMTP session, so the sender is told immediately and you don't create backscatter.

Avoid the advanced **Discard (Not Recommended)** option. It deletes mail silently, and cPanel warns that "the sender will not know that the delivery failed." Note also that, according to cPanel's docs, domain forwarders override the default address, so check **Forwarders** too. The [cPanel/WHM platform notes](https://iblockspam.com/platforms/cpanel-whm) and [external spam filter for cPanel/WHM](https://iblockspam.com/blog/external-spam-filter-cpanel-whm) cover how this fits with an MX-level filter.

## What should you use instead of a catch-all?

You can get almost all of the benefits without accepting every address.

1. **Specific aliases for addresses that matter.** Add `info@`, `sales@`, `billing@` and common misspellings of key addresses as aliases. Google Workspace lets you add "up to 30 aliases for each user, at no extra cost," according to [Google's alias help page](https://knowledge.workspace.google.com/admin/users/add-or-delete-an-alternate-email-address-email-alias).
2. **Shared mailboxes or groups for team addresses.** Several people can work one address without a catch-all.
3. **Plus addressing for sign-ups.** Mail to `name+tag@yourdomain` is delivered to `name@yourdomain`. [Microsoft Learn](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online) says plus addressing "is enabled by default in Exchange Online," and the [RFC 5233](https://www.rfc-editor.org/rfc/rfc5233.html) subaddressing pattern is widely supported. You get unlimited labeled addresses that still only reach a real user.
4. **Keep departing staff addresses for a fixed time.** Convert them to an alias on a manager's mailbox or a shared mailbox, then remove them after an agreed period.
5. **Reject unknown recipients everywhere in the path.** If an inbound filter or gateway sits in front of your mailbox, make sure it rejects unknown recipients during the SMTP session too, not just your mail server.

## How to switch off a catch-all safely

1. **Look before you leap.** Review two to four weeks of catch-all mail. List every address that received a real message.
2. **Create aliases** for the legitimate addresses on that list.
3. **Turn off the catch-all** using the platform steps above.
4. **Test.** Send to a made-up address from an outside account and confirm you get an immediate bounce, not silence.
5. **Watch for a week.** Ask staff to report missed mail, and check your mail logs or message trace for rejected recipients that look legitimate.
6. **Clean up.** Delete or archive the old catch-all mailbox once nothing real is arriving.

## Next steps

- Run the [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your MX, SPF and DMARC records are in order before and after the change.
- Find your receiving servers with the [MX Lookup](https://iblockspam.com/tools/mx-lookup), then test a made-up address and read the bounce in the [SMTP error code lookup](https://iblockspam.com/tools/smtp-error-codes).
- If spam is still high after removing the catch-all, read [how to stop spam for a whole domain](https://iblockspam.com/blog/stop-spam-for-whole-domain).
- If you put an MX-level filter such as iBlockSpam in front of your mailboxes, confirm it rejects unknown recipients during the SMTP session as well. See [how iBlockSpam works](https://iblockspam.com/how-it-works).

## Frequently asked questions

### What is a catch-all email address?

A catch-all (also called a default address or accept-all) is a mailbox that receives every message sent to an address at your domain that doesn't otherwise exist. Mail to sales@, salse@ or anything-at-all@ your domain is delivered to it instead of being rejected as an unknown recipient.

### Does Microsoft 365 support a catch-all mailbox?

There's no simple catch-all setting. When a domain is Authoritative, Directory-Based Edge Blocking rejects mail for unknown recipients with 550 5.4.1 before filtering. Workarounds change the domain to Internal relay and add a mail flow rule, which turns off that edge rejection. Microsoft says not to use Internal relay when all recipients are in Microsoft 365.

### How do I turn off the catch-all in cPanel?

Open Default Address in cPanel, choose the domain, and select the option to discard the email at SMTP time with an error message. That rejects mail for unknown addresses during the SMTP session. Avoid the silent Discard option: cPanel itself marks it not recommended because the sender never learns the delivery failed.

### Will turning off the catch-all make me lose email?

Only mail to addresses you haven't set up, and senders get an immediate bounce telling them so. Before switching it off, review a few weeks of catch-all mail, find the addresses that receive real messages, and create aliases for those. Then legitimate mail keeps arriving and guesses are rejected.

### Are catch-all addresses bad for deliverability?

For your inbound mail, they mostly add spam. They can also hurt your outbound reputation if your server accepts mail for unknown addresses and bounces it later, or forwards a catch-all mailbox to another provider. Both send unwanted mail to other servers from your IP addresses.

## Sources

- [cPanel Documentation: Default Address](https://docs.cpanel.net/cpanel/email/default-address/)
- [Google Workspace Admin Help: Get misaddressed email in a catch-all mailbox](https://knowledge.workspace.google.com/admin/gmail/advanced/get-misaddressed-email-in-a-catch-all-mailbox)
- [Microsoft Learn: Use Directory-Based Edge Blocking to reject messages sent to invalid recipients](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-directory-based-edge-blocking)
- [Microsoft Learn: Manage accepted domains in Exchange Online](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains)
- [Microsoft Learn: Plus addressing in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/plus-addressing-in-exchange-online)
- [Google Workspace Admin Help: Add or delete an alternate email address (email alias)](https://knowledge.workspace.google.com/admin/users/add-or-delete-an-alternate-email-address-email-alias)
- [RFC 5321: Simple Mail Transfer Protocol, section 6.2](https://www.rfc-editor.org/rfc/rfc5321.html#section-6.2)
- [RFC 6647: Email Greylisting, section 4.2 (directory harvesting)](https://www.rfc-editor.org/rfc/rfc6647.html#section-4.2)

## Free tools for this guide

- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.
- [SMTP Error Code Lookup](https://iblockspam.com/tools/smtp-error-codes): Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.

---

Source: iBlockSpam, https://iblockspam.com/blog/catch-all-email-address-spam (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt