← All writing

Catch-all addresses are a spam magnet

20 July 2026 · 4 min read

A catch-all accepts every local part. Dictionary attacks then land every time: info@, sales@, admin@, and ten thousand others all arrive, and none of them bounce, so the sender learns your domain accepts everything.

What it costs you

• Volume that never stops growing.
• No signal about which addresses are real.
• Reputation damage if you bounce it later, which is backscatter.

What to do instead

Name the addresses you actually use and refuse the rest during the SMTP conversation. If you need throwaway addresses, use a service that gives you distinct ones you can switch off, rather than a wildcard that can only be all or nothing.