{"id":283,"date":"2026-07-16T12:52:16","date_gmt":"2026-07-16T07:22:16","guid":{"rendered":"https:\/\/emailalias.io\/blog\/?p=283"},"modified":"2026-07-16T12:52:19","modified_gmt":"2026-07-16T07:22:19","slug":"catch-all-email-address","status":"publish","type":"post","link":"https:\/\/emailalias.io\/blog\/catch-all-email-address\/","title":{"rendered":"What Is a Catch-All Email Address?"},"content":{"rendered":"\n<p>A <strong>catch-all email address<\/strong> accepts mail sent to <em>any<\/em> address at your domain \u2014 <code>hello@<\/code>, <code>sales@<\/code>, <code>anything-you-just-made-up@<\/code> \u2014 and delivers all of it to one inbox. It sounds like the perfect setup: you never miss an email, and you can invent addresses on the spot without creating them first. In practice, that same open-door design is why a catch-all email address becomes a spam magnet, and why it gives you almost no control when something goes wrong. This guide explains how catch-alls actually work, the trade-offs nobody mentions, why the spam problem creeps up on you months later, when one genuinely makes sense, how to switch one off without losing mail, and the per-alias alternative that keeps the convenience without the flood.<\/p>\n\n\n\n<nav class=\"post-toc\" aria-label=\"Table of contents\">\n  <h2 class=\"post-toc__title\">Table of contents<\/h2>\n  <ol class=\"post-toc__list\">\n    <li><a href=\"#what-is-a-catch-all-email-address\">What is a catch-all email address<\/a><\/li>\n    <li><a href=\"#how-a-catch-all-email-address-works\">How a catch-all email address works<\/a><\/li>\n    <li><a href=\"#why-people-use-a-catch-all\">Why people use a catch-all<\/a><\/li>\n    <li><a href=\"#why-a-catch-all-is-a-spam-magnet\">Why a catch-all is a spam magnet<\/a><\/li>\n    <li><a href=\"#catch-all-vs-per-alias-forwarding\">Catch-all vs per-alias forwarding<\/a><\/li>\n    <li><a href=\"#when-a-catch-all-makes-sense\">When a catch-all makes sense<\/a><\/li>\n    <li><a href=\"#the-safer-setup\">The safer setup<\/a><\/li>\n    <li><a href=\"#how-to-switch-off-a-catch-all\">How to switch off a catch-all<\/a><\/li>\n    <li><a href=\"#final-thoughts\">Final thoughts<\/a><\/li>\n    <li><a href=\"#frequently-asked-questions\">Frequently asked questions<\/a><\/li>\n  <\/ol>\n<\/nav>\n\n\n\n<h2 class=\"wp-block-heading\">What is a catch-all email address<\/h2>\n\n\n\n<p>A catch-all email address \u2014 sometimes called a wildcard address \u2014 is a rule on a domain you own that says: &#8220;deliver mail for <em>every<\/em> address at this domain to this inbox, whether or not that address was ever set up.&#8221; Instead of creating <code>hello@yourdomain.com<\/code> and <code>billing@yourdomain.com<\/code> individually, the catch-all quietly accepts all of them, plus every address nobody has ever used.<\/p>\n\n\n\n<p>The key word is <em>every<\/em>. A normal mail setup rejects mail to an address that doesn&#8217;t exist \u2014 the sender gets a bounce. A catch-all never rejects anything; by definition it has no concept of an address that doesn&#8217;t exist at your domain. That single design choice is the source of both its appeal and every problem in this article. It only applies to domains you control, so it&#8217;s a custom-domain feature, not something you can do on a shared inbox like Gmail.<\/p>\n\n\n\n<p>It&#8217;s worth clearing up some terminology, because people use several names for the same thing. A catch-all email address is also called a wildcard address, a catch-all mailbox, or sometimes just &#8220;the catch-all.&#8221; A few providers describe it as a &#8220;default address&#8221; or &#8220;fallback recipient&#8221; in their settings. They all mean the same rule: mail for any unmatched address at this domain goes here. If you&#8217;ve seen a checkbox in your DNS or mail-hosting panel labelled anything like that, it&#8217;s this feature \u2014 and enabling it has all the consequences below, regardless of what the label says. Knowing the synonyms matters, because a catch-all email address is often switched on by default at some hosts, and plenty of domain owners have one running without realising it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How a catch-all email address works<\/h2>\n\n\n\n<p>Mechanically it&#8217;s straightforward, and it takes about a minute to set up. You point your domain&#8217;s MX records at a mail provider, then find and enable the catch-all (wildcard) rule in that provider&#8217;s settings, naming a destination inbox for everything to land in. From then on, when a message arrives for <code>anything@yourdomain.com<\/code>, the provider checks for a specific mailbox or alias for that address; if none exists, the catch-all rule sweeps it up and delivers it to your chosen inbox anyway. It&#8217;s ordinary <a href=\"https:\/\/en.wikipedia.org\/wiki\/Email_forwarding\" rel=\"noopener\" target=\"_blank\">email forwarding<\/a> with the matching rule set to &#8220;everything.&#8221;<\/p>\n\n\n\n<p>That&#8217;s the whole mechanism. There&#8217;s no filtering, no verification, and no list of valid recipients \u2014 the domain simply says yes to every address. Compare that with an <a href=\"https:\/\/en.wikipedia.org\/wiki\/Email_alias\" rel=\"noopener\" target=\"_blank\">email alias<\/a> setup, where each address is explicitly created and anything not on the list is refused. Same infrastructure, opposite default: a catch-all is allow-by-default, aliases are deny-by-default. As with most things in security, the default matters enormously.<\/p>\n\n\n\n<p>That allow-versus-deny distinction is the single most useful thing to understand here, because every other difference flows from it. Security people have a name for this principle \u2014 default deny \u2014 and it&#8217;s the reason firewalls block everything except what you permit, rather than permitting everything except what you block. The logic is that you can enumerate what you want, but you can never enumerate everything you don&#8217;t. A catch-all email address takes the opposite bet: it assumes accepting everything is safe because the bad stuff is rare. That assumption holds right up until spammers notice your domain, at which point the bet turns against you permanently, and you have no mechanism to claw it back.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why people use a catch-all<\/h2>\n\n\n\n<p>Catch-alls are popular for good reasons, and it&#8217;s worth stating them fairly before the criticism \u2014 nobody enables one out of carelessness, they enable it because it solves a real problem elegantly:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>You never miss mail.<\/strong> A typo&#8217;d address \u2014 <code>sasles@yourdomain.com<\/code> \u2014 still arrives instead of bouncing. For a business, that&#8217;s a genuine save.<\/li>\n\n\n\n<li><strong>Addresses on demand.<\/strong> You can invent <code>shop-name@yourdomain.com<\/code> at a checkout without setting it up first, which makes per-service addressing effortless.<\/li>\n\n\n\n<li><strong>Zero admin.<\/strong> No creating, naming, or maintaining a list of addresses. Turn it on once and forget it.<\/li>\n\n\n\n<li><strong>Great for small teams.<\/strong> Everything to the domain lands in one place, so nothing falls through the cracks while you&#8217;re small.<\/li>\n<\/ul>\n\n\n\n<p>Notice that the second point \u2014 inventing an address per service on the fly \u2014 is the same privacy habit that makes aliasing so valuable. That&#8217;s why a catch-all email address feels like a shortcut to per-service addressing. The trouble is what else comes through the same open door.<\/p>\n\n\n\n<p>This is genuinely how a lot of privacy-minded people first discover per-service addressing: they buy a domain, flip on the wildcard, and start giving every shop its own made-up address. And for a while it works beautifully \u2014 you can see exactly which company leaked you when <code>randomshop@yourdomain.com<\/code> starts getting junk. The realisation comes later, when you try to <em>do<\/em> something about it and find there&#8217;s no lever to pull. Diagnosis without treatment is the catch-all&#8217;s whole story: it tells you who leaked your address, then leaves you unable to close the door on them. That&#8217;s the gap a proper <a href=\"https:\/\/emailalias.io\/email-alias-service\/\" rel=\"noopener\" target=\"_blank\">email alias service<\/a> fills.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why a catch-all is a spam magnet<\/h2>\n\n\n\n<p>Here&#8217;s the part the &#8220;just enable catch-all&#8221; advice skips, and it&#8217;s the single biggest reason to think twice. Because your domain accepts every possible address, it&#8217;s an ideal target for the oldest trick in the spam playbook \u2014 and unlike most spam problems, this one you&#8217;ve opted into by design.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-style-default\">\n  <img data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/diagram-catch-all-email-address.jpg?resize=1080%2C567&#038;ssl=1\"\n       alt=\"Why a catch-all email address is a spam magnet: an open gate accepts every address including spam, while per-alias forwarding uses individual doors you can close\"\n       width=\"1080\" height=\"567\"\n       loading=\"lazy\" decoding=\"async\" \/>\n  <figcaption>A catch-all email address is an open gate \u2014 every invented address gets in, including a spammer&#8217;s guesses \u2014 while per-alias forwarding uses individual doors you can close one at a time.<\/figcaption>\n<\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dictionary attacks work by default.<\/strong> Spammers run <a href=\"https:\/\/en.wikipedia.org\/wiki\/Directory_harvest_attack\" target=\"_blank\" rel=\"noopener\">directory harvest attacks<\/a> \u2014 blasting common names (<code>info@<\/code>, <code>admin@<\/code>, <code>john@<\/code>) at a domain to see what sticks. Against a normal setup, most bounce. Against a catch-all, <em>every single guess lands in your inbox<\/em>.<\/li>\n\n\n\n<li><strong>You can&#8217;t disable one bad address.<\/strong> This is the big one. If <code>shop@yourdomain.com<\/code> gets sold to spammers, you can&#8217;t switch it off \u2014 the catch-all accepts it by definition. Your only options are a filter or killing the catch-all entirely.<\/li>\n\n\n\n<li><strong>Leak tracing loses its teeth.<\/strong> Per-service addressing is meant to reveal who leaked you <em>and<\/em> let you revoke that address. A catch-all gives you the first half and none of the second.<\/li>\n\n\n\n<li><strong>Backscatter and reputation.<\/strong> Accepting mail for every address means accepting junk aimed at addresses that were never yours, which can drag your domain into <a href=\"https:\/\/en.wikipedia.org\/wiki\/Backscatter_(email)\" target=\"_blank\" rel=\"noopener\">backscatter<\/a> and reputation problems.<\/li>\n\n\n\n<li><strong>It compounds.<\/strong> Once a domain is known to accept everything, it gets added to lists as a live target, so the <a href=\"https:\/\/en.wikipedia.org\/wiki\/Email_spam\" target=\"_blank\" rel=\"noopener\">spam<\/a> volume grows over time rather than settling.<\/li>\n<\/ul>\n\n\n\n<p>The pattern is that a catch-all&#8217;s one strength \u2014 never rejecting anything \u2014 is precisely its weakness. You wanted &#8220;never miss a real email&#8221; and you also got &#8220;never reject a fake one.&#8221; And crucially, you gave up the off switch that makes per-service addressing genuinely useful.<\/p>\n\n\n\n<p>The way this plays out over time is worth picturing, because a catch-all email address rarely feels like a problem on day one. A new domain is quiet: nothing is on any list, so the wildcard sweeps up only your real mail and it seems like a free win. Then, somewhere between a few months and a year in, the volume starts climbing. Your domain has been probed, found to accept everything, and traded around. Now every message aimed at <code>admin@<\/code>, <code>postmaster@<\/code>, <code>billing@<\/code>, and a thousand random names you never used is landing in your inbox, forever. Nothing changed on your end \u2014 you simply became a known-good target, and there&#8217;s no undoing that reputation while the wildcard stays on. By the time it hurts, you&#8217;ve usually forgotten you enabled it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Catch-all vs per-alias forwarding<\/h2>\n\n\n\n<p>The alternative isn&#8217;t &#8220;go back to one address for everything&#8221; \u2014 nobody is suggesting you give up per-service addressing. It&#8217;s to create each address explicitly instead of accepting all of them blindly. Per-alias forwarding on your own domain gives you the same invent-an-address-per-service habit, but every address is real, listed, and revocable. The table shows exactly where the two diverge.<\/p>\n\n\n\n<figure class=\"wp-block-table\">\n  <table>\n    <caption>Catch-all vs per-alias forwarding on a custom domain, on control and spam exposure<\/caption>\n    <thead>\n      <tr><th>Feature<\/th><th>Catch-all<\/th><th>Per-alias forwarding<\/th><\/tr>\n    <\/thead>\n    <tbody>\n      <tr><td>Unknown addresses<\/td><td>All accepted<\/td><td>Rejected<\/td><\/tr>\n      <tr><td>Dictionary-attack spam<\/td><td>Every guess lands<\/td><td>Bounces<\/td><\/tr>\n      <tr><td>Disable one address<\/td><td>No<\/td><td>Yes \u2014 one click<\/td><\/tr>\n      <tr><td>Trace a leak to its source<\/td><td>Partly<\/td><td>Yes<\/td><\/tr>\n      <tr><td>Addresses on demand<\/td><td>Yes \u2014 no setup<\/td><td>Yes \u2014 generate in seconds<\/td><\/tr>\n      <tr><td>Catches typo&#8217;d addresses<\/td><td>Yes<\/td><td>No<\/td><\/tr>\n      <tr><td>Admin overhead<\/td><td>None<\/td><td>Minimal<\/td><\/tr>\n    <\/tbody>\n  <\/table>\n<\/figure>\n\n\n\n<p>The honest read: a catch-all wins on catching typos and needing zero setup. Per-alias forwarding wins on everything that matters once spam or a leak shows up \u2014 rejection of junk by default, and a real off switch per address. Given that generating an alias now takes about as long as typing one, the catch-all&#8217;s convenience advantage has mostly evaporated. You can see the model in our guide to <a href=\"https:\/\/emailalias.io\/blog\/how-email-aliases-work\/\" rel=\"noopener\" target=\"_blank\">how email aliases work<\/a>.<\/p>\n\n\n\n<p>Look closely at the &#8220;trace a leak&#8221; row, because it&#8217;s the one that surprises people. Both approaches tell you <em>who<\/em> leaked your address \u2014 that&#8217;s just a property of giving each service a different one. But only the alias lets you act on the information. With a catch-all, discovering that a retailer sold you out leaves you with a shrug and a filter rule; with an alias, it&#8217;s a single click and the address is dead. Knowing without being able to act is a booby prize, and it&#8217;s the reason so many catch-all users eventually migrate: they didn&#8217;t want a leak detector, they wanted a leak <em>stopper<\/em>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When a catch-all makes sense<\/h2>\n\n\n\n<p>To be fair, there are situations where a catch-all is the right call, and this isn&#8217;t a blanket &#8220;never use one&#8221;. The question to ask is simple: <em>what does a missed email cost me, and what does an extra hundred spam messages a day cost me?<\/em> Whichever number is bigger decides it. Here&#8217;s where the catch-all wins that comparison:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>A business where a missed email costs real money.<\/strong> If a customer typing <code>sales@<\/code> wrong means a lost order, catching the typo is worth the spam.<\/li>\n\n\n\n<li><strong>A brand-new, unknown domain.<\/strong> Freshly registered domains aren&#8217;t on spam lists yet, so a catch-all is quiet at first \u2014 just know that it won&#8217;t stay that way.<\/li>\n\n\n\n<li><strong>Behind good filtering, temporarily.<\/strong> If you have strong spam filtering and you&#8217;re migrating or auditing what arrives at a domain, a catch-all is a useful diagnostic.<\/li>\n\n\n\n<li><strong>A domain you don&#8217;t care about.<\/strong> A side project where the inbox is noise anyway loses nothing.<\/li>\n<\/ul>\n\n\n\n<p>Outside those, the trade is usually bad \u2014 especially for personal use, where the entire point of using your own domain is control. And note the common workaround people land on: enable the catch-all, then add filters to fight the resulting flood. That&#8217;s solving a problem you created, when a deny-by-default setup wouldn&#8217;t have created it.<\/p>\n\n\n\n<p>There&#8217;s a hybrid worth knowing about, too. Some people keep a catch-all email address on a <em>business<\/em> domain \u2014 where catching a typo&#8217;d order is worth real money \u2014 while running a separate personal domain with per-alias forwarding and no wildcard at all. That split gets you the safety net exactly where a missed message is expensive, and deny-by-default everywhere else. If you go that route, keep the two domains genuinely separate: don&#8217;t hand out addresses on the catch-all domain for personal signups, or you&#8217;ve reintroduced the same open door by the back gate. The point is to match the setting to the cost of a missed email, rather than applying one rule to everything you own.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The safer setup<\/h2>\n\n\n\n<p>If what you actually want is &#8220;a different address for every service, on my own domain, without the spam,&#8221; then you don&#8217;t want a wildcard at all \u2014 you want per-alias forwarding. It delivers every benefit that drew you to the catch-all in the first place, and none of the exposure. Here&#8217;s what the setup looks like:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Bring your own domain.<\/strong> Add your domain, publish the DNS records, and use branded addresses just as you would with a catch-all.<\/li>\n\n\n\n<li><strong>Generate an alias per service.<\/strong> Create one in seconds with an <a href=\"https:\/\/emailalias.io\/email-alias-generator\/\" target=\"_blank\" rel=\"noopener\">email alias generator<\/a> whenever you sign up for something \u2014 the on-demand habit, kept.<\/li>\n\n\n\n<li><strong>Unknown addresses bounce.<\/strong> Dictionary attacks hit a wall instead of your inbox, because addresses you never created simply don&#8217;t exist.<\/li>\n\n\n\n<li><strong>Disable any address instantly.<\/strong> When one leaks or turns spammy, switch off that alias alone \u2014 the thing a catch-all can never do.<\/li>\n\n\n\n<li><strong>Trace every leak.<\/strong> Since each alias went to exactly one service, spam on it tells you precisely who sold you out.<\/li>\n<\/ul>\n\n\n\n<p>You get the domain, the per-service addresses, and the privacy \u2014 minus the open door. On <a href=\"https:\/\/emailalias.io\/custom-domain-email-alias\/\" rel=\"noopener\" target=\"_blank\">EmailAlias.io custom domains<\/a> this is the default model, with up to 5 domains on Premium, and you can start with <strong>10 aliases free<\/strong> on a shared domain to try the workflow before bringing a domain across. These are permanent, manageable addresses \u2014 <a href=\"https:\/\/emailalias.io\/not-disposable-email\/\" rel=\"noopener\" target=\"_blank\">not disposable inboxes<\/a> that vanish on you.<\/p>\n\n\n\n<p>The objection people raise at this point is fair: doesn&#8217;t creating each alias add friction that the catch-all didn&#8217;t have? Honestly, barely. The whole reason wildcards were attractive was that, years ago, adding an address meant logging into a mail server and provisioning a mailbox \u2014 genuinely annoying. Today it&#8217;s a click in a dashboard or a browser-extension button that drops a fresh address straight into the signup form you&#8217;re already looking at. The gap between &#8220;invent an address&#8221; and &#8220;generate an address&#8221; has closed to about a second, which is why the catch-all&#8217;s convenience case has largely dissolved. You&#8217;re trading one second per signup for a permanent off switch on every address you own. That&#8217;s not a close call. For a walkthrough of the day-to-day flow, see how a <a href=\"https:\/\/emailalias.io\/private-email-alias\/\" rel=\"noopener\" target=\"_blank\">private email alias<\/a> works in practice.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to switch off a catch-all<\/h2>\n\n\n\n<p>If you already run a catch-all email address and the spam has crept up on you, migrating away is easier than it sounds \u2014 and you don&#8217;t have to lose the addresses you actually use. The fear that stops people is usually &#8220;what if something important was arriving at an address I&#8217;ve forgotten about?&#8221;, and the fix for that is simply to look before you leap:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Audit what genuinely arrives.<\/strong> Before changing anything, look through a few weeks of mail and list the addresses at your domain that real people and services actually use. It&#8217;s usually a much shorter list than you expect \u2014 a handful, not hundreds.<\/li>\n\n\n\n<li><strong>Create a real alias for each one.<\/strong> Recreate every address from that list explicitly, so the mail you care about keeps flowing once the catch-all is gone.<\/li>\n\n\n\n<li><strong>Run both briefly.<\/strong> Keep the catch-all on for a week or two alongside the aliases and watch for anything legitimate that isn&#8217;t on your list, then add it.<\/li>\n\n\n\n<li><strong>Turn the catch-all off.<\/strong> Flip the wildcard rule off. From that moment, invented and guessed addresses bounce instead of landing, and the dictionary-attack flood simply stops.<\/li>\n\n\n\n<li><strong>Generate aliases on demand from then on.<\/strong> Every new signup gets a fresh alias, which preserves the on-the-fly habit that made the catch-all appealing in the first place.<\/li>\n<\/ul>\n\n\n\n<p>The relief is usually immediate and permanent. Because spam aimed at a catch-all email address is mostly sent to addresses that were never real, removing the wildcard removes the entire category at a stroke \u2014 no filter rules to maintain, no ongoing battle. For the mail that&#8217;s already reaching your real addresses, pair this with our guide on <a href=\"https:\/\/emailalias.io\/how-to-stop-email-spam\/\" rel=\"noopener\" target=\"_blank\">how to stop email spam<\/a>, and see our <a href=\"https:\/\/emailalias.io\/blog\/custom-domain-email-alias\/\" rel=\"noopener\" target=\"_blank\">custom domain email alias guide<\/a> for the full domain setup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Final thoughts<\/h2>\n\n\n\n<p>A catch-all email address is a reasonable tool that&#8217;s widely used for the wrong job. Its genuine strength is catching mail you&#8217;d otherwise miss \u2014 a typo&#8217;d business address, an old address you forgot existed, a customer who guessed at your contact details and got it slightly wrong. Its fatal flaw for personal privacy is that it can&#8217;t say no: every guess a spammer makes lands in your inbox, and you can&#8217;t revoke a single address once it leaks, no matter how badly you want to.<\/p>\n\n\n\n<p>If you&#8217;re running a business domain where a missed order is expensive, turn one on and pair it with serious filtering. If you&#8217;re a person who owns a domain and wants a different address for every service, skip the catch-all and use per-alias forwarding instead \u2014 same convenience, deny-by-default, and an off switch for every address you hand out. Start with <strong>10 aliases free<\/strong> on <a href=\"https:\/\/emailalias.io\/pricing\/\" rel=\"noopener\" target=\"_blank\">EmailAlias.io<\/a>, add your domain when you&#8217;re ready, and enjoy your own domain without the open gate.<\/p>\n\n\n\n<p>And if you&#8217;re reading this because your inbox has quietly filled with mail addressed to people who don&#8217;t exist at your domain \u2014 that&#8217;s your answer. That&#8217;s not bad luck or a filtering failure; it&#8217;s a catch-all email address doing exactly what it was designed to do. The fix isn&#8217;t a smarter filter, it&#8217;s a different default. Switch the wildcard off, recreate the handful of addresses you actually use as real aliases, and the flood stops at the door instead of in your inbox. Most people who make that change describe the same thing afterwards: a domain that finally feels like theirs again, and an inbox that only contains mail meant for them.<\/p>\n\n\n\n<h2 id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1784185752596\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is a catch-all email address?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A catch-all email address is a rule on a domain you own that delivers mail for every possible address at that domain to one inbox, whether or not the address was ever created. Also called a wildcard address, it never rejects anything \u2014 so hello@, sales@, and any address someone invents all arrive. It only works on domains you control, so it&#8217;s a custom-domain feature.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185766818\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How does a catch-all email address work?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You point your domain&#8217;s MX records at a mail provider and enable the catch-all or wildcard rule, naming a destination inbox. When mail arrives for any address at the domain, the provider looks for a specific mailbox or alias; if none exists, the catch-all sweeps it up and delivers it anyway. It&#8217;s ordinary forwarding with the matching rule set to &#8220;everything.&#8221;<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185790935\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is a catch-all email address a good idea?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>It depends on the job. For a business where a typo&#8217;d address means a lost order, catching that mail can be worth it. For personal privacy it&#8217;s usually a bad trade, because it accepts every spam guess aimed at your domain and gives you no way to disable a single address once it leaks. Per-alias forwarding gives the same convenience without those problems.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185804924\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Why does a catch-all get so much spam?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Because it can&#8217;t reject anything. Spammers run directory harvest attacks \u2014 blasting common names like info@, admin@, and john@ at a domain to see what sticks. A normal setup bounces most of those, but a catch-all accepts every single guess and delivers it to you. Once a domain is known to accept everything, it gets flagged as a live target and the volume grows over time.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185823469\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the difference between a catch-all and an email alias?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They&#8217;re opposite defaults on the same infrastructure. A catch-all is allow-by-default: every address at your domain works, including ones you never made. An alias is deny-by-default: each address is explicitly created, and anything not on the list bounces. That difference is why an alias can be disabled individually and a catch-all cannot.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185837151\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Can I disable a single address on a catch-all?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No, and that&#8217;s its core limitation. Because the catch-all accepts every address by definition, there&#8217;s no individual address to switch off. If one gets sold to spammers, your only options are to add a filter or disable the catch-all entirely. With per-alias forwarding you just switch off that one alias and everything else keeps working.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185853255\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Should I use a catch-all with my custom domain?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Only for specific cases \u2014 a business where missed mail is costly, a brand-new domain that isn&#8217;t on spam lists yet, or a temporary diagnostic behind strong filtering. For personal use on a domain you care about, per-alias forwarding is the safer default: you still get branded, per-service addresses, but unknown addresses bounce and every alias has an off switch.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1784185864027\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the alternative to a catch-all email address?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Per-alias forwarding on your own domain. You add your domain, then generate an address per service on demand \u2014 keeping the convenience \u2014 while unknown addresses bounce, every alias can be disabled individually, and each leak is traceable to one source. EmailAlias.io supports custom domains (up to 5 on Premium), and you can start with 10 aliases free on a shared domain first.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>A catch-all email address accepts mail sent to any address at your domain \u2014 hello@, sales@, anything-you-just-made-up@ \u2014 and delivers all of it to one inbox. It sounds like the&#8230;<\/p>\n","protected":false},"author":3,"featured_media":284,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1],"tags":[],"class_list":{"0":"post-283","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-email-alias"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/og-catch-all-email-address.jpg?fit=1200%2C630&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":241,"url":"https:\/\/emailalias.io\/blog\/improvmx-alternative\/","url_meta":{"origin":283,"position":0},"title":"ImprovMX Alternative: An Honest Review","author":"Troy Hunt","date":"July 7, 2026","format":false,"excerpt":"If you're hunting for an ImprovMX alternative, you're probably in one of two camps: you love the idea of email forwarding on your own domain but want stronger privacy, or you've hit a limit ImprovMX simply isn't built to solve. ImprovMX is a genuinely good custom-domain forwarder \u2014 but it's\u2026","rel":"","context":"In &quot;Comparisons&quot;","block_context":{"text":"Comparisons","link":"https:\/\/emailalias.io\/blog\/category\/comparisons\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/og-improvmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/og-improvmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/og-improvmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/og-improvmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/07\/og-improvmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":137,"url":"https:\/\/emailalias.io\/blog\/custom-domain-email-alias\/","url_meta":{"origin":283,"position":1},"title":"Custom Domain Email Alias: Setup, DNS, and Why It Matters","author":"Troy Hunt","date":"June 7, 2026","format":false,"excerpt":"A custom domain email alias is a forwarding address on a domain you own \u2014 something like hello@janedoe.com instead of jane-doe-2026@alias-domain \u2014 that delivers inbound mail to your real inbox without ever exposing it. The domain is yours, the DNS is yours, the address is yours; the alias provider just\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":21,"url":"https:\/\/emailalias.io\/blog\/best-email-alias-services\/","url_meta":{"origin":283,"position":2},"title":"Best Email Alias Services in 2026 for Privacy &amp; Spam Protection","author":"Troy Hunt","date":"May 15, 2026","format":false,"excerpt":"Email alias services have quietly become one of the most important privacy tools of 2026. Every time you hand over your real address \u2014 to a newsletter, a shopping cart, a recruiter, a one-off support form - you give the recipient a permanent key to your inbox and your identity.\u2026","rel":"","context":"In &quot;Comparisons&quot;","block_context":{"text":"Comparisons","link":"https:\/\/emailalias.io\/blog\/category\/comparisons\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/header-emailalias.jpg?fit=1200%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/header-emailalias.jpg?fit=1200%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/header-emailalias.jpg?fit=1200%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/header-emailalias.jpg?fit=1200%2C400&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/header-emailalias.jpg?fit=1200%2C400&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":180,"url":"https:\/\/emailalias.io\/blog\/how-to-detect-disposable-emails\/","url_meta":{"origin":283,"position":3},"title":"How to Detect Disposable Emails Without Blocking Real Users","author":"Troy Hunt","date":"June 17, 2026","format":false,"excerpt":"If you run a signup form, you already know you need to detect disposable emails before they create accounts you'll never hear from again. But every public disposable-email blocklist on the internet has the same blind spot: it flags legitimate forwarding aliases \u2014 addresses on EmailAlias.io, SimpleLogin, addy.io, DuckDuckGo Email\u2026","rel":"","context":"In &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/emailalias.io\/blog\/category\/security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-how-to-detect-disposable-emails.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-how-to-detect-disposable-emails.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-how-to-detect-disposable-emails.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-how-to-detect-disposable-emails.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-how-to-detect-disposable-emails.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":309,"url":"https:\/\/emailalias.io\/blog\/forwardmx-alternative\/","url_meta":{"origin":283,"position":4},"title":"ForwardMX Alternative: What to Use Instead","author":"Troy Hunt","date":"August 21, 2026","format":false,"excerpt":"ForwardMX is a capable email-forwarding service, but it is not the right fit for everyone \u2014 and if you have landed here, you are probably weighing a ForwardMX alternative for a specific reason. Maybe you do not own a domain and do not want to. Maybe you want a free\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-forwardmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-forwardmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-forwardmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-forwardmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-forwardmx-alternative.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":47,"url":"https:\/\/emailalias.io\/blog\/what-is-an-email-alias\/","url_meta":{"origin":283,"position":5},"title":"What Is an Email Alias? Complete Guide for 2026","author":"Troy Hunt","date":"May 17, 2026","format":false,"excerpt":"An email alias is a forwarding address that hides your real inbox while still delivering every message you receive \u2014 newsletters, receipts, password resets \u2014 straight to the inbox you already use. Instead of handing out your primary address to every website, store, and signup form, you generate a separate\u2026","rel":"","context":"In &quot;Email Aliases&quot;","block_context":{"text":"Email Aliases","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-alias.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/comments?post=283"}],"version-history":[{"count":1,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/283\/revisions"}],"predecessor-version":[{"id":286,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/283\/revisions\/286"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media\/284"}],"wp:attachment":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media?parent=283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/categories?post=283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/tags?post=283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}