Catch-all email addresses

What a catch-all actually is

Normally, a mail server knows a fixed list of addresses. Send to one that is not on the list and the server rejects it — the sender gets a bounce saying the recipient does not exist.

A catch-all removes the list. Every address on the domain is valid, whether or not anyone created it. hello@, stripe-2026@, this-one-is-for-that-newsletter@ — all delivered, all yours.

Written as an address it is *@your-domain.com, and the asterisk is doing exactly what you would expect.

What it is genuinely good for

A different address for every signup

Give each service its own address — netflix@, bank@, that-conference@. You never invent them in advance and you never configure them. When spam starts arriving at that-conference@, you know precisely who sold or lost your address, and you can drop mail to it with one rule.

This is the same idea as Gmail's +tag trick, minus its fatal flaw: everyone knows to strip a plus tag, and plenty of signup forms reject the + outright. A distinct local-part looks like an ordinary address because it is one.

Never losing mail to a typo

Someone writes to suport@ or hellp@. Without a catch-all that message bounces and you never learn it existed. With one, it lands.

Per-customer and per-project addresses

Generate an address per customer, ticket, or deployment — order-8814@, build-3f2a@ — and use the recipient as the routing key. Nothing needs provisioning, because there is nothing to provision.

Test suites that need real email

End-to-end tests that exercise signup and confirmation need a fresh, real address per run. A catch-all domain plus a webhook gives the test runner the confirmation mail directly, without an IMAP poller in your CI pipeline.

The honest downside

A catch-all cannot bounce a dictionary attack. Spammers guess local-parts against domains, and where a fixed list rejects the guesses, a catch-all accepts them.

It is less dramatic than it sounds. Spam filtering happens before delivery, so most of it never reaches you. What does get through is easy to contain, because the recipient address is itself the signal: routing rules can drop by sender, subject, or recipient pattern, and a compromised per-signup address is one rule away from silence — no bounce, no unsubscribe link, no negotiation.

The pattern that keeps this manageable is to use named aliases for the addresses you publish widely, and let the catch-all handle the long tail.

Setting one up

1. Add your domain and set the two MX records — per-provider instructions.
2. Create an alias and turn on catch-all. One toggle; it applies to the whole domain.
3. Choose what happens to the mail. Read it in the MXcatch inbox, forward it to a mailbox you already use, POST it to a webhook, or archive it.

Named aliases still win over the catch-all, so support@ can have its own actions while everything else falls through to the general rule.

Catch-all on other providers

Google Workspace and Microsoft 365 both support a catch-all, and both make you route it to a real, licensed mailbox — you are paying per seat for a bucket. Cloudflare Email Routing offers a free catch-all but only forwards to verified destination addresses, so the mail has to end up in somebody's existing inbox. ImprovMX does the same thing for forwarding.

MXcatch treats the catch-all as an event source rather than a redirect: forward it if you want, but you can just as easily archive it, post it to Slack, or turn it into JSON.