An administrator configures a catch-all so that nothing is lost. A customer writing to saels@ instead of sales@ still reaches somebody. It is a sensible operational choice and it destroys the only signal a verifier has.
Verification works by opening an SMTP connection and asking about one recipient. A server with no catch-all answers 550 for an address that does not exist, which is a real answer. A catch-all server answers 250 for every address you name, including one you invented on the spot.
That last part is how we detect it. We probe a random local part that cannot plausibly exist. If the server accepts that too, the domain accepts everything, and no further probing will separate a real mailbox from an imaginary one.
In a 10,000-email B2B benchmark, around 28% of addresses sat on catch-all domains. On a business list that is not an edge case. It is nearly a third of your data sitting behind a door that opens for anyone.
Why catch-all is so common in B2B
Google Workspace and Microsoft 365 both let an administrator route unmatched mail to a default recipient. Small companies turn it on so an inquiry is never lost. Larger ones inherit it from a migration nobody revisited.
Security gateways make it worse. When Proofpoint, Mimecast or Barracuda sits in front of a tenant, the appliance answers the probe rather than the mail system, and many of them accept all recipients by design.
The result is that the domains most likely to be catch-all are exactly the business domains a B2B sender cares most about.
Where this argument costs us something
The short version
- Expect roughly a quarter to a third of a B2B list to be unverifiable at mailbox level.
- Segment catch-all addresses rather than deleting them or treating them as confirmed.
- Judge them on engagement, because that is the only signal available once the protocol has nothing to say.
Questions people ask
Can any verifier confirm an address on a catch-all domain?
Not through SMTP. The server accepts every recipient, so there is no answer to read. Anything more confident than that is inference.
Should I delete catch-all addresses?
No. Many are real and some are your best prospects. Put them in their own segment and send to them after your confirmed addresses have established a pattern.