tmailrDeliverability
Catch-all addresses are a spam magnet
20 July 2026 · 2 min read · TMailr
A catch-all accepts mail for every address at your domain, including the ones that do not exist. It sounds like insurance against typos and it is, in practice, a standing invitation.
What you are agreeing to
Dictionary attacks are cheap. A spammer works through info@, sales@, admin@, john@, jane@ and thousands more against every domain they have. Against a normal server the invalid ones are refused at the door and the sender learns which addresses exist, which is bad enough. Against a catch-all every single one is accepted.
So you receive the whole dictionary, forever, and the spammer learns that your domain accepts anything, which is worth marking in their list.
The reputation cost, which is the part people miss
Refusing invalid recipients is one of the few positive signals a receiving server can observe about you, and accepting everything throws it away. Worse, accepting mail you then discard makes any bounce you generate backscatter, aimed at whoever the envelope claimed sent it, which is usually somebody who did not.
Spam filters also learn from what your users mark. A mailbox full of dictionary spam is a mailbox generating complaints, and those attach to your domain.
When a catch-all is right
Two cases. A test environment where every address has to work by design, and a system that generates addresses faster than they can be provisioned, such as per-ticket reply addresses. Both should live on a subdomain of their own, so the behaviour is contained and the reputation is separate from the domain your people use.
Our own developer sandboxes are exactly this: a catch-all on a dedicated domain, deliberately kept away from anything a human reads.
What to do instead
- List the addresses that exist and refuse the rest at RCPT time.
- Add explicit aliases for the handful of typos that matter, rather than accepting all of them.
- Publish the role addresses you are obliged to have, postmaster and abuse, and read them.
- For per-relationship addresses, use aliases you can switch off individually.
Refusing is a signal, and it is one of the few you own
Almost everything about your reputation is decided by other people: who complains, who marks you as spam, who never opens anything. Refusing invalid recipients is one of the small number of things a receiving server can observe about you directly, and it reads as a domain that knows who its users are.
The inverse reads badly. A domain that accepts every address in a dictionary attack looks like a domain with no directory behind it, which is what an abandoned or compromised domain looks like. You are not penalised for the spam arriving, you are judged on having nothing to say about who should be receiving mail.
If you already have one
Turning it off is not a small change, because you will discover addresses in use that nobody documented. Do it in stages: log what the catch-all receives for a fortnight, promote the addresses that are real to explicit ones, then switch to refusing. The log is the whole job; the switch takes a minute.
More on deliverability
