Skip to content
Spaw
Get your API key

catch_all

The server accepts every address at the domain, so the mailbox cannot be confirmed

A catch-all (accept-all) server answers OK to any recipient, including ones that do not exist, so the handshake proves nothing about this particular mailbox.

appears in
reason
verdict
risky
risk weight
+30
credits
1 credit, like every deliverable or risky answer. Repeats of the same address are free for 7 days.

What it means

Corporate domains behind Proofpoint or Mimecast, and many Microsoft 365 tenants, are configured to accept all recipients and sort them out later. Spaw remembers a catch-all answer per domain for seven days and does not spend further probes on that domain. Behind a security gateway (mx_provider_type security_gateway) the catch-all is the gateway's design rather than a squat, so the score carries catch_all_gateway at 15 instead of catch_all at 30; the reason is catch_all either way.

mailbox_exists stays null. mailbox_confidence gives a recomputable 0 to 100 estimate built from the domain's DMARC and SPF, its provider, registration age, the shape of the username, whether that shape follows the naming convention seen in the domain's confirmed deliveries, and the delivery feedback reported for the domain. A relay alias stays at 50 and only a bounce rate of 50% or more or a plus-tag lowers it, because the domain's records describe the relay operator.

What to do

Send in moderation and report outcomes through the feedback endpoint: your own delivered reports turn later lookups of that address into confirmed mailboxes, and bounces feed the confidence score for the whole domain.

Example response 

{
    "email": "[email protected]",
    "deliverable": "risky",
    "reason": "catch_all",
    "catch_all": true,
    "mailbox_exists": null,
    "mailbox_confidence": 72
}

Abbreviated: a real answer carries all 46 fields, listed in the verify-email reference.

Related

markdown version: /docs/reasons/catch_all.md