Catch-All Email Verification: How to Actually Resolve Accept-All Domains
Catch-all domains accept mail for any address, so a normal SMTP check cannot confirm an individual mailbox. Learn how to separate uncertainty from a usable verdict, and what an additional check costs.
Short answer
A catch-all (accept-all) domain accepts mail to any address, so an SMTP check can't prove a specific mailbox exists. The only reliable resolutions are a second-pass deliverability engine that tests behaviour beyond the accept, or corroborating the address from an independent source. OS Tools offers Risky Email Rescue separately at 10 credits per address. Results can still be Risky; Invalid and Unknown outcomes are refunded, while Safe and Risky are charged.
- Never bulk-send to unresolved catch-alls — they're the main hidden source of hard bounces.
- Don't delete them either — a large share are real mailboxes at real companies.
- Do resolve what you can, then send the remainder on a separate warmed domain at low volume.
Why catch-all exists
An administrator configures the domain to accept mail to any local part so that misaddressed mail isn't lost. How this is configured depends on the mail provider and administrator. The result: anything@company.com gets a 250 OK at the SMTP layer, whether or not a mailbox exists behind it.
That's fatal for standard verification, which relies on the receiving server rejecting unknown recipients. No rejection means no signal.
What each approach can and can't do
| Approach | What it does | Resolves catch-all? |
|---|---|---|
| Syntax + MX check | Validates format and that the domain accepts mail | No |
| Standard SMTP RCPT check | Asks the server if the mailbox exists | No — server accepts everything |
| Database/cache lookup | Returns a previously observed verdict | Only if the address was seen before |
| Second-pass deliverability engine | Tests behaviour beyond the accept to separate real mailboxes from accepted-then-discarded | Often, but not always |
| Independent corroboration | Confirms the person and pattern from another source | Partially — raises confidence, not proof |
| Send-and-observe | Low-volume send on an isolated domain, watch bounces | Definitively — but at reputation risk |
The commercial problem: paying for non-answers
Most verifiers bill per address submitted, including addresses returned as unknown, risky or accept-all. For a hypothetical example, if 30% of a 10,000-row list is catch-all, you have paid for 3,000 rows and learned nothing about them. Your effective cost per actionable verdict is approximately 1.43x the headline rate.
Two things fix this: a vendor that attempts a genuine second pass, and a vendor that refunds when it still can't decide. OS Tools offers optional Risky Email Rescue at 10 credits per address. Invalid and Unknown outcomes are refunded; Safe and Risky are charged. This is separate from the 1-credit bulk verifier.
A practical playbook
- Segment. Split the verified file into valid, invalid, and catch-all/unknown. Never merge them back into one send.
- Second-pass the catch-alls. Whatever resolves, moves to the valid segment.
- Prioritise by pattern confidence. An address matching the domain's observed pattern (first.last@) at a company where you have other confirmed contacts is far safer than a guessed pattern.
- Isolate the send. Remaining catch-alls go out from a separate warmed domain, 20–30 per day, so bounces can't damage your primary sending reputation.
- Watch the bounce rate per segment. If the catch-all segment bounces above 5%, stop and re-source rather than pushing volume.
Keep overall hard bounces under 2%, and ideally under 1%. Mailbox providers read bounce rate as a spam signal, and reputation damage from a single bad send can take months to recover.
What not to do
- Don't treat accept-all as valid. It's the single most common cause of a "verified" list bouncing.
- Don't discard them wholesale unless deliverability risk outweighs the pipeline — plenty of good accounts run catch-all.
- Don't re-verify the same address across three vendors hoping one says valid. They're all guessing at the same missing signal; you're just paying three times.
Frequently asked questions
What is a catch-all email address?
A catch-all (or accept-all) domain is configured to accept mail sent to any address at that domain, whether or not the mailbox exists. Standard verification can't tell a real mailbox from a typo on such a domain, so most tools return 'unknown'.
Is it safe to email catch-all addresses?
Only with care. Unresolved catch-alls are the main hidden source of hard bounces on 'verified' lists. Send them from a separate warmed domain at low daily volume, monitor bounces per segment, and stop if the segment exceeds about 5%.
Can catch-all emails be verified at all?
Some can. A second-pass deliverability engine tests behaviour beyond the initial accept and resolves a meaningful share of them. The rest are genuinely undecidable without sending, which is why a vendor that refunds unresolved results is worth more than one claiming to verify everything.
What percentage of a B2B list is catch-all?
There is no single reliable percentage for every B2B list. It varies with target companies, providers and list sources. Measure the Risky/catch-all share of your own results rather than treating a general estimate as a forecast.
Should I pay for unknown or risky results?
Compare each tool’s billing rules. OS Tools charges returned bulk Safe, Risky and Invalid results. Optional Risky Email Rescue costs 10 credits per address; Invalid and Unknown outcomes are refunded, Safe and Risky charged.
Try it
OS Tools is pay-as-you-go with no subscription — you only pay for what you actually run. Upload a CSV, get the cleaned file back with your original columns preserved.