# `catch_all`: the domain accepts every address, so the mailbox cannot be confirmed

The handshake said yes to a recipient that cannot exist, so a yes for this one proves nothing; mailbox_confidence estimates the rest.

- Weight: +30
- Dataset: mailbox-smtp
- Read from: `catch_all`
- Verdict reasons it comes with: `catch_all`

A catch-all answer is remembered per domain for seven days, so later addresses at the domain are answered from memory rather than probed. Behind a security gateway — Proofpoint, Mimecast, Barracuda — the lighter catch_all_gateway weight of 15 takes the place of this one, because accepting every recipient is the gateway's design rather than a squat.

It reads from the catch_all field and comes with the catch_all verdict reason.

**What to do.** Read mailbox_confidence, or set a confidence floor in the sending policy; report outcomes so the domain's naming convention and bounce share sharpen the estimate.

```json
{
    "email": "mia@acme.com",
    "deliverable": "risky",
    "reason": "catch_all",
    "catch_all": true,
    "mailbox_confidence": 70,
    "risk_signals": [
        {
            "signal": "catch_all",
            "weight": 30,
            "dataset": "mailbox-smtp"
        }
    ]
}
```

Reference: https://spaw.co/docs/signals/catch_all