What Is a Catch-All Email Address?

A catch-all email address accepts mail sent to any address at your domain — hello@, sales@, anything-you-just-made-up@ — and delivers all of it to one inbox. It sounds like the perfect setup: you never miss an email, and you can invent addresses on the spot without creating them first. In practice, that same open-door design is why a catch-all email address becomes a spam magnet, and why it gives you almost no control when something goes wrong. This guide explains how catch-alls actually work, the trade-offs nobody mentions, why the spam problem creeps up on you months later, when one genuinely makes sense, how to switch one off without losing mail, and the per-alias alternative that keeps the convenience without the flood.

What is a catch-all email address

A catch-all email address — sometimes called a wildcard address — is a rule on a domain you own that says: “deliver mail for every address at this domain to this inbox, whether or not that address was ever set up.” Instead of creating hello@yourdomain.com and billing@yourdomain.com individually, the catch-all quietly accepts all of them, plus every address nobody has ever used.

The key word is every. A normal mail setup rejects mail to an address that doesn’t exist — the sender gets a bounce. A catch-all never rejects anything; by definition it has no concept of an address that doesn’t exist at your domain. That single design choice is the source of both its appeal and every problem in this article. It only applies to domains you control, so it’s a custom-domain feature, not something you can do on a shared inbox like Gmail.

It’s worth clearing up some terminology, because people use several names for the same thing. A catch-all email address is also called a wildcard address, a catch-all mailbox, or sometimes just “the catch-all.” A few providers describe it as a “default address” or “fallback recipient” in their settings. They all mean the same rule: mail for any unmatched address at this domain goes here. If you’ve seen a checkbox in your DNS or mail-hosting panel labelled anything like that, it’s this feature — and enabling it has all the consequences below, regardless of what the label says. Knowing the synonyms matters, because a catch-all email address is often switched on by default at some hosts, and plenty of domain owners have one running without realising it.

How a catch-all email address works

Mechanically it’s straightforward, and it takes about a minute to set up. You point your domain’s MX records at a mail provider, then find and enable the catch-all (wildcard) rule in that provider’s settings, naming a destination inbox for everything to land in. From then on, when a message arrives for anything@yourdomain.com, the provider checks for a specific mailbox or alias for that address; if none exists, the catch-all rule sweeps it up and delivers it to your chosen inbox anyway. It’s ordinary email forwarding with the matching rule set to “everything.”

That’s the whole mechanism. There’s no filtering, no verification, and no list of valid recipients — the domain simply says yes to every address. Compare that with an email alias setup, where each address is explicitly created and anything not on the list is refused. Same infrastructure, opposite default: a catch-all is allow-by-default, aliases are deny-by-default. As with most things in security, the default matters enormously.

That allow-versus-deny distinction is the single most useful thing to understand here, because every other difference flows from it. Security people have a name for this principle — default deny — and it’s the reason firewalls block everything except what you permit, rather than permitting everything except what you block. The logic is that you can enumerate what you want, but you can never enumerate everything you don’t. A catch-all email address takes the opposite bet: it assumes accepting everything is safe because the bad stuff is rare. That assumption holds right up until spammers notice your domain, at which point the bet turns against you permanently, and you have no mechanism to claw it back.

Why people use a catch-all

Catch-alls are popular for good reasons, and it’s worth stating them fairly before the criticism — nobody enables one out of carelessness, they enable it because it solves a real problem elegantly:

• You never miss mail. A typo’d address — sasles@yourdomain.com — still arrives instead of bouncing. For a business, that’s a genuine save.
• Addresses on demand. You can invent shop-name@yourdomain.com at a checkout without setting it up first, which makes per-service addressing effortless.
• Zero admin. No creating, naming, or maintaining a list of addresses. Turn it on once and forget it.
• Great for small teams. Everything to the domain lands in one place, so nothing falls through the cracks while you’re small.

Notice that the second point — inventing an address per service on the fly — is the same privacy habit that makes aliasing so valuable. That’s why a catch-all email address feels like a shortcut to per-service addressing. The trouble is what else comes through the same open door.

This is genuinely how a lot of privacy-minded people first discover per-service addressing: they buy a domain, flip on the wildcard, and start giving every shop its own made-up address. And for a while it works beautifully — you can see exactly which company leaked you when randomshop@yourdomain.com starts getting junk. The realisation comes later, when you try to do something about it and find there’s no lever to pull. Diagnosis without treatment is the catch-all’s whole story: it tells you who leaked your address, then leaves you unable to close the door on them. That’s the gap a proper email alias service fills.

Why a catch-all is a spam magnet

Here’s the part the “just enable catch-all” advice skips, and it’s the single biggest reason to think twice. Because your domain accepts every possible address, it’s an ideal target for the oldest trick in the spam playbook — and unlike most spam problems, this one you’ve opted into by design.

• Dictionary attacks work by default. Spammers run directory harvest attacks — blasting common names (info@, admin@, john@) at a domain to see what sticks. Against a normal setup, most bounce. Against a catch-all, every single guess lands in your inbox.
• You can’t disable one bad address. This is the big one. If shop@yourdomain.com gets sold to spammers, you can’t switch it off — the catch-all accepts it by definition. Your only options are a filter or killing the catch-all entirely.
• Leak tracing loses its teeth. Per-service addressing is meant to reveal who leaked you and let you revoke that address. A catch-all gives you the first half and none of the second.
• Backscatter and reputation. Accepting mail for every address means accepting junk aimed at addresses that were never yours, which can drag your domain into backscatter and reputation problems.
• It compounds. Once a domain is known to accept everything, it gets added to lists as a live target, so the spam volume grows over time rather than settling.

The pattern is that a catch-all’s one strength — never rejecting anything — is precisely its weakness. You wanted “never miss a real email” and you also got “never reject a fake one.” And crucially, you gave up the off switch that makes per-service addressing genuinely useful.

The way this plays out over time is worth picturing, because a catch-all email address rarely feels like a problem on day one. A new domain is quiet: nothing is on any list, so the wildcard sweeps up only your real mail and it seems like a free win. Then, somewhere between a few months and a year in, the volume starts climbing. Your domain has been probed, found to accept everything, and traded around. Now every message aimed at admin@, postmaster@, billing@, and a thousand random names you never used is landing in your inbox, forever. Nothing changed on your end — you simply became a known-good target, and there’s no undoing that reputation while the wildcard stays on. By the time it hurts, you’ve usually forgotten you enabled it.

Catch-all vs per-alias forwarding

The alternative isn’t “go back to one address for everything” — nobody is suggesting you give up per-service addressing. It’s to create each address explicitly instead of accepting all of them blindly. Per-alias forwarding on your own domain gives you the same invent-an-address-per-service habit, but every address is real, listed, and revocable. The table shows exactly where the two diverge.

The honest read: a catch-all wins on catching typos and needing zero setup. Per-alias forwarding wins on everything that matters once spam or a leak shows up — rejection of junk by default, and a real off switch per address. Given that generating an alias now takes about as long as typing one, the catch-all’s convenience advantage has mostly evaporated. You can see the model in our guide to how email aliases work.

Look closely at the “trace a leak” row, because it’s the one that surprises people. Both approaches tell you who leaked your address — that’s just a property of giving each service a different one. But only the alias lets you act on the information. With a catch-all, discovering that a retailer sold you out leaves you with a shrug and a filter rule; with an alias, it’s a single click and the address is dead. Knowing without being able to act is a booby prize, and it’s the reason so many catch-all users eventually migrate: they didn’t want a leak detector, they wanted a leak stopper.

When a catch-all makes sense

To be fair, there are situations where a catch-all is the right call, and this isn’t a blanket “never use one”. The question to ask is simple: what does a missed email cost me, and what does an extra hundred spam messages a day cost me? Whichever number is bigger decides it. Here’s where the catch-all wins that comparison:

• A business where a missed email costs real money. If a customer typing sales@ wrong means a lost order, catching the typo is worth the spam.
• A brand-new, unknown domain. Freshly registered domains aren’t on spam lists yet, so a catch-all is quiet at first — just know that it won’t stay that way.
• Behind good filtering, temporarily. If you have strong spam filtering and you’re migrating or auditing what arrives at a domain, a catch-all is a useful diagnostic.
• A domain you don’t care about. A side project where the inbox is noise anyway loses nothing.

Outside those, the trade is usually bad — especially for personal use, where the entire point of using your own domain is control. And note the common workaround people land on: enable the catch-all, then add filters to fight the resulting flood. That’s solving a problem you created, when a deny-by-default setup wouldn’t have created it.

There’s a hybrid worth knowing about, too. Some people keep a catch-all email address on a business domain — where catching a typo’d order is worth real money — while running a separate personal domain with per-alias forwarding and no wildcard at all. That split gets you the safety net exactly where a missed message is expensive, and deny-by-default everywhere else. If you go that route, keep the two domains genuinely separate: don’t hand out addresses on the catch-all domain for personal signups, or you’ve reintroduced the same open door by the back gate. The point is to match the setting to the cost of a missed email, rather than applying one rule to everything you own.

The safer setup

If what you actually want is “a different address for every service, on my own domain, without the spam,” then you don’t want a wildcard at all — you want per-alias forwarding. It delivers every benefit that drew you to the catch-all in the first place, and none of the exposure. Here’s what the setup looks like:

• Bring your own domain. Add your domain, publish the DNS records, and use branded addresses just as you would with a catch-all.
• Generate an alias per service. Create one in seconds with an email alias generator whenever you sign up for something — the on-demand habit, kept.
• Unknown addresses bounce. Dictionary attacks hit a wall instead of your inbox, because addresses you never created simply don’t exist.
• Disable any address instantly. When one leaks or turns spammy, switch off that alias alone — the thing a catch-all can never do.
• Trace every leak. Since each alias went to exactly one service, spam on it tells you precisely who sold you out.

You get the domain, the per-service addresses, and the privacy — minus the open door. On EmailAlias.io custom domains this is the default model, with up to 5 domains on Premium, and you can start with 10 aliases free on a shared domain to try the workflow before bringing a domain across. These are permanent, manageable addresses — not disposable inboxes that vanish on you.

The objection people raise at this point is fair: doesn’t creating each alias add friction that the catch-all didn’t have? Honestly, barely. The whole reason wildcards were attractive was that, years ago, adding an address meant logging into a mail server and provisioning a mailbox — genuinely annoying. Today it’s a click in a dashboard or a browser-extension button that drops a fresh address straight into the signup form you’re already looking at. The gap between “invent an address” and “generate an address” has closed to about a second, which is why the catch-all’s convenience case has largely dissolved. You’re trading one second per signup for a permanent off switch on every address you own. That’s not a close call. For a walkthrough of the day-to-day flow, see how a private email alias works in practice.

How to switch off a catch-all

If you already run a catch-all email address and the spam has crept up on you, migrating away is easier than it sounds — and you don’t have to lose the addresses you actually use. The fear that stops people is usually “what if something important was arriving at an address I’ve forgotten about?”, and the fix for that is simply to look before you leap:

• Audit what genuinely arrives. Before changing anything, look through a few weeks of mail and list the addresses at your domain that real people and services actually use. It’s usually a much shorter list than you expect — a handful, not hundreds.
• Create a real alias for each one. Recreate every address from that list explicitly, so the mail you care about keeps flowing once the catch-all is gone.
• Run both briefly. Keep the catch-all on for a week or two alongside the aliases and watch for anything legitimate that isn’t on your list, then add it.
• Turn the catch-all off. Flip the wildcard rule off. From that moment, invented and guessed addresses bounce instead of landing, and the dictionary-attack flood simply stops.
• Generate aliases on demand from then on. Every new signup gets a fresh alias, which preserves the on-the-fly habit that made the catch-all appealing in the first place.

The relief is usually immediate and permanent. Because spam aimed at a catch-all email address is mostly sent to addresses that were never real, removing the wildcard removes the entire category at a stroke — no filter rules to maintain, no ongoing battle. For the mail that’s already reaching your real addresses, pair this with our guide on how to stop email spam, and see our custom domain email alias guide for the full domain setup.

Final thoughts

A catch-all email address is a reasonable tool that’s widely used for the wrong job. Its genuine strength is catching mail you’d otherwise miss — a typo’d business address, an old address you forgot existed, a customer who guessed at your contact details and got it slightly wrong. Its fatal flaw for personal privacy is that it can’t say no: every guess a spammer makes lands in your inbox, and you can’t revoke a single address once it leaks, no matter how badly you want to.

If you’re running a business domain where a missed order is expensive, turn one on and pair it with serious filtering. If you’re a person who owns a domain and wants a different address for every service, skip the catch-all and use per-alias forwarding instead — same convenience, deny-by-default, and an off switch for every address you hand out. Start with 10 aliases free on EmailAlias.io, add your domain when you’re ready, and enjoy your own domain without the open gate.

And if you’re reading this because your inbox has quietly filled with mail addressed to people who don’t exist at your domain — that’s your answer. That’s not bad luck or a filtering failure; it’s a catch-all email address doing exactly what it was designed to do. The fix isn’t a smarter filter, it’s a different default. Switch the wildcard off, recreate the handful of addresses you actually use as real aliases, and the flood stops at the door instead of in your inbox. Most people who make that change describe the same thing afterwards: a domain that finally feels like theirs again, and an inbox that only contains mail meant for them.

Frequently asked questions