catch_all

The domain accepts every address, so the mailbox cannot be confirmed

The handshake said yes to a recipient that cannot exist, so a yes for this one proves nothing; mailbox_confidence estimates the rest.

risk weight: +30
dataset: mailbox-smtp
reads from: catch_all
verdict reason: catch_all

What it means

A catch-all answer is remembered per domain for seven days, so later addresses at the domain are answered from memory rather than probed. Behind a security gateway — Proofpoint, Mimecast, Barracuda — the lighter catch_all_gateway weight of 15 takes the place of this one, because accepting every recipient is the gateway's design rather than a squat.

It reads from the catch_all field and comes with the catch_all verdict reason.

What to do

Read mailbox_confidence, or set a confidence floor in the sending policy; report outcomes so the domain's naming convention and bounce share sharpen the estimate.

Example response

{
    "email": "[email protected]",
    "deliverable": "risky",
    "reason": "catch_all",
    "catch_all": true,
    "mailbox_confidence": 70,
    "risk_signals": [
        {
            "signal": "catch_all",
            "weight": 30,
            "dataset": "mailbox-smtp"
        }
    ]
}

Abbreviated: a real answer carries all 46 fields, listed in the verify-email reference. The risk_signals entry shown is the one this signal adds; the weights of every entry in the list sum to risk_score.

markdown version: /docs/signals/catch_all.md

catch_all

What it means

What to do

Example response

Related