Catch-all address
A catch-all address (or catch-all mailbox) is a mail server configuration that delivers messages sent to any address at a domain -- including addresses that were never specifically created -- to one designated inbox instead of bouncing them as undeliverable. It's commonly used so a typo in a customer's email, like sales@ instead of sale@, still reaches someone, but it carries a real security and hygiene cost: a domain with a catch-all accepts mail to any made-up address, making it a convenient target for spammers harvesting addresses, and it prevents legitimate bounce messages (RFC 3464 delivery status notifications) from ever signaling that an address doesn't exist. This also interacts with backscatter, where a server using a catch-all forwards or auto-responds to spoofed senders instead of silently dropping mail to nonexistent addresses. AdminKit's guide to email bounces and backscatter explains how this failure mode shows up and how to avoid it.
By AdminKit team, Netbase JSC · Updated