- Risky email, defined
- A risky email is an address a verifier marks as neither safe nor bad, most often because its domain accepts every recipient or its server gave no answer.
Risky is a label, not an SMTP reply. No mail server ever answers "risky". It's a verifier's summary of the results that fall between a clear 250 and a clear 550, and each tool draws that line in its own place.
Scrubby's FAQ, read on 2026-09-25, files catch-all addresses under risky and names disposable, spam-trap and role addresses such as info@ and admin@ as common risky types. Hunter's guide to risky mailboxes, read the same day, stretches the word further: spam traps, honeypots, inactive mailboxes and bot signups.
Most of the bucket comes from two causes. A catch-all domain answers 250 to every RCPT TO, even for an address someone just made up, so the handshake can't tell a real person from a typo. An unknown result means the server stalled instead: greylisting, throttling, a timeout or a block on probe traffic.
Those two causes call for different decisions. A catch-all address at a company you sell to is often worth a small, slow send. An unknown is worth a second check a few hours later, because a greylisting server usually answers properly on the retry.
Expect a lot of it on business lists. In one 10,000-address B2B benchmark, about 28% of addresses sat on catch-all domains. So a risky share in the twenties says little about a B2B list on its own. Read should you remove catch-all emails before you delete a quarter of your file.
Role and disposable addresses are a separate question. They're about who reads the mailbox, not whether it exists. sales@ at a real company can be perfectly deliverable, while a disposable inbox may be empty by the time your campaign goes out.
How ZapBounce reports it
ZapBounce has no risky bucket. Every row comes back as one of four results, valid, invalid, catch_all or unknown, and role, disposable and free_provider travel beside it as true-or-false flags. A catch-all role address reads as catch_all with role: true, so you set the rule instead of inheriting ours. unknown rows are never billed, and each batch summary counts all four results, so you see how much of the file reached a verdict before you send. Per-check prices sit on the pricing page.
Risky email: common questions
Should I send to risky emails?
Send to the catch-all share carefully and hold the rest until it's rechecked. Catch-all addresses on real company domains are often reachable, while disposable addresses rarely are. Keep catch-alls to a small slice of each send and watch your bounce rate, which is healthy under 2%.
Is a risky email the same as a catch-all email?
No. Catch-all is one cause of a risky label. Unanswered probes, disposable domains and role addresses land in the same bucket on some tools, which is why the label alone can't drive a send decision.
Why did a verifier mark my own work address risky?
Your company's domain most likely accepts every recipient. When a server answers 250 for a random address too, no outside SMTP check can confirm one mailbox on that domain, so tools that use the risky label put it there.
Do risky addresses hurt sender reputation?
Only the ones that bounce or turn out to be traps. A catch-all address that reaches a real person does no harm. Mailbox providers track your bounce and complaint rates, so a risky address that lands safely never counts against you.