# `catch_all_gateway`: a catch-all behind a security gateway

The domain accepts every address but its mail runs through Proofpoint, Mimecast or Barracuda, where accepting every recipient is the gateway's design; this lighter weight takes the place of the catch-all one.

- Weight: +15
- Dataset: mailbox-smtp
- Read from: `mx_provider_type`
- Verdict reasons it comes with: `catch_all`

It fires when mx_provider_type is security_gateway and catch_all is true. The gateway accepts recipients and sorts them out behind, so the catch-all says less about the domain than a squat's would; the verdict reason stays catch_all and mailbox_confidence still estimates the mailbox.

Exactly one of catch_all and catch_all_gateway ever fires on an answer.

**What to do.** The same as for catch_all: read mailbox_confidence and report outcomes.

```json
{
    "email": "mia@acme.com",
    "deliverable": "risky",
    "reason": "catch_all",
    "catch_all": true,
    "mx_provider": "proofpoint",
    "mx_provider_type": "security_gateway",
    "risk_signals": [
        {
            "signal": "catch_all_gateway",
            "weight": 15,
            "dataset": "mailbox-smtp"
        }
    ]
}
```

Reference: https://spaw.co/docs/signals/catch_all_gateway