# `catch_all`: the server accepts every address at the domain, so the mailbox cannot be confirmed

A catch-all (accept-all) server answers OK to any recipient, including ones that do not exist, so the handshake proves nothing about this particular mailbox.

- Appears in: `reason`
- Verdict: risky
- Risk weight: +30
- Billing: 1 credit, like every deliverable or risky answer. Repeats of the same address are free for 7 days.

Corporate domains behind Proofpoint or Mimecast, and many Microsoft 365 tenants, are configured to accept all recipients and sort them out later. Spaw remembers a catch-all answer per domain for seven days and does not spend further probes on that domain.

mailbox_exists stays null. mailbox_confidence gives a recomputable 0 to 100 estimate built from the domain's DMARC and SPF, its provider, registration age, the shape of the username, and your own delivery feedback for the domain.

**What to do.** Send in moderation and report outcomes through the feedback endpoint: your own delivered reports turn later lookups of that address into confirmed mailboxes, and bounces feed the confidence score for the whole domain.

```json
{
    "email": "mia@acme.com",
    "deliverable": "risky",
    "reason": "catch_all",
    "catch_all": true,
    "mailbox_exists": null,
    "mailbox_confidence": 72
}
```

Reference: https://spaw.co/docs/reasons/catch_all