Probe a real address at a catch-all domain and the server replies 250. Probe an address you made up a second ago and it replies 250 again. You get the same answer for a real mailbox and a fake one, so no SMTP check can tell them apart.
So when a vendor says it resolves catch-all addresses, you're reading about a different kind of verdict. It comes from other signals: a record of past bounces at that domain, the shape of the local part, whether the address shows up in public sources, or a test send. Each one moves the odds. None of them reads the mailbox.
Scale is why this matters. In a 10,000-email B2B benchmark, about 28% of addresses sat on catch-all domains. That's more than a quarter of a business list, and the label your verifier puts on it decides whether you send to it.
ZapBounce handles it the way the protocol allows. We probe one random address at the same domain. If that also gets 250, the result is catch_all with the reason accept_all_domain, billed once and never guessed further. The smtp_code field carries the literal reply, so you can audit our reading. The full pipeline is on how it works.
How to read a resolved catch-all verdict
Start by asking which signal produced the verdict. A vendor who names it, whether that's bounce history, a test send or a pattern model, gives you something you can weigh. A vendor who just calls it verified is asking you to treat a guess as a fact.
Next, check how the result is labelled in your export. Once a catch-all address is promoted to valid, it looks exactly like a confirmed mailbox inside your ESP. The risk is still there, and the evidence for it is gone.
Then test it on your own list. Send a small first wave to the catch-all segment, watch the bounce rate, and widen the send only while it stays low. Your own bounces are the one signal on that segment that describes your list rather than a model's view of it.
If you're deciding whether to keep those addresses at all, should I remove catch-all emails walks through it, and the rest of the ZapBounce blog covers the other results a verifier can return.
Where a scored catch-all earns its place
The short version
- Treat any verdict on a catch-all domain beyond catch_all as a probability, and ask which signal produced it.
- Keep catch-all addresses in their own segment so the label survives the import into your ESP.
- Send to that segment in a small first wave and let your own bounce rate decide how far to widen it.
Questions people ask
Can a catch-all email be verified at mailbox level?
No. A catch-all server returns 250 for every recipient, including invented ones, so an SMTP check gets the same answer for a real mailbox and a fake one. Any stronger verdict comes from outside signals such as bounce history or a test send.
Why is a catch-all result billed when unknown is free?
A catch_all result is a real finding. It takes a full handshake plus a second probe with a random address, and it tells you something true about the domain. An unknown is the absence of an answer, which is why ZapBounce never bills it.
Should I send to catch-all addresses?
Yes, in their own segment and in stages. Many are real mailboxes, and a small first send shows you that segment's bounce rate before you commit the rest of it.
How much of a B2B list is usually catch-all?
About 28% in a 10,000-email B2B benchmark. Lists heavy in Yahoo-hosted domains run higher, because Yahoo replies 250 to every probe to stop address harvesting.