You can run the test by hand. Ask the server about a local part nobody could have registered, something like q7x4zz-nobody@theirdomain.com. A normal server answers 550. A catch-all server answers 250, and the 250 you got for your real address turns out to have carried no information at all.
The share is large on business data. In one 10,000-address B2B benchmark, about 28% of the list sat on domains set up this way. That's more than a quarter of your file, and how a verifier reports that quarter moves its headline accuracy figure more than the quality of its engine does.
Vendors handle it in three ways. Some report it as its own state. Some fold it into a risky bucket. Some resolve it to valid, which raises the published accuracy number while emptying it of meaning, because the hard addresses have left the denominator.
Other services add a guess on top of the protocol result. ZeroBounce scores catch-all addresses on a scale of 1 to 10, and Bouncer says it "can further resolve some catch-all addresses" (both read on the vendors' own sites, 24 September 2026). A score like that draws on patterns and history, not on the mail server. Treat it as a ranking for which catch-alls to send to first, and keep it apart from a verdict.
ZapBounce answers the question with a fixed set of four results: valid, invalid, catch_all and unknown. A domain that accepts the random address gets catch_all on every row, so you see the exact count before you send. The SMTP check that proves it closes before any message is sent, and each row carries the server's literal reply code so you can audit the reading yourself.
What to do with them is a separate question from whether they can be checked. Most catch-all addresses at real companies belong to real people. Send to them in their own batch, keep them out of your main campaign so any bounces stay contained, and let the engagement data decide. See should you remove catch-all emails for the sending plan, or run a whole file through bulk verification to get the catch-all count first.
What 2,800 unproven addresses do to one send
Say your list holds 10,000 business addresses. A careful check finds 6,200 valid, 1,000 invalid and 2,800 on catch-all domains. Some vendors fold catch-all into valid, and one of those hands you a tidy report: 9,000 good, 1,000 bad. You mail the 9,000.
Now suppose one in ten of those catch-all addresses is dead, which isn't a wild guess for data that came from a pattern tool. That's 280 hard bounces on a send of 9,000, or 3.1%. You're over the 2% line on that group alone, and your report said the list was clean.
With the honest report you'd have mailed 6,200 first, then the 2,800 as a test group. The same 280 bounces would land in a send you were watching, and your main campaign would stay clear of them.
Five questions to put to a vendor about catch-all
Ask whether they run the random-address test on every domain, or only on some. A vendor that skips it can't know which of its valid verdicts are real.
Find out what label the result gets. If it's called risky, or it's folded into a score, ask which other findings share that label. You want catch-all in a pile of its own, so you can count it.
When a vendor says it resolves catch-all addresses, press for the method and for how often it's wrong. An honest answer names the data behind the guess and gives the guess its own label.
Put the billing question plainly, since you'll pay for a lot of these on a business list. And ask to see the raw server reply on each row. With a 250 for your address and a 250 for a made-up one in front of you, nobody has to take anyone's word for it.
Related questions
Does any verifier resolve catch-all addresses?
No verifier can resolve them over SMTP, because the server says yes to every address. Some vendors add a score from patterns and history; ZeroBounce, for example, rates catch-alls from 1 to 10. That score is an estimate and works best as a send order.
Can you verify a catch-all email without sending to it?
You can prove the domain is catch-all without sending anything: one probe with a random address that also returns 250 settles it. What stays open is whether the one mailbox you care about exists, and only a real send answers that.
Is a catch-all email the same as a risky email?
Often, yes. Many tools file catch-all addresses under a risky or accept-all label, sometimes mixed with other findings. ZapBounce keeps catch_all as one of four fixed results, so the count on your report means one thing only.
What share of a B2B list is catch-all?
About 28% in one 10,000-address B2B benchmark. Consumer lists usually carry fewer, with one exception: Yahoo and AOL accept every address by design, so their users read as catch-all too.
Why do vendors report catch-all so differently?
Because the catch-all bucket is where an accuracy percentage is made. Leaving it out of the denominator raises the published number by the size of that bucket, often a quarter of a B2B list, without improving the check.