A catch-all domain is one whose mail server accepts mail addressed to every recipient, whether or not that mailbox exists. It is also called accept-all. The server answers 250 OK at the RCPT TO step for any name, then sorts the mail out afterwards — delivering what matches a real mailbox, forwarding the rest, or dropping it.
What Spaw answers
The field is catch_all. When it is true the handshake proved that the domain receives mail and proved nothing about the mailbox, so the verdict is risky with the reason catch_all and the risk score carries +30. mailbox_exists stays null, because no honest answer can be given.
Spaw does not report a catch-all address as deliverable, ever. The verdict names what was established rather than what is likely.
What it does not mean
Catch-all is a property of the domain, not of the address. Most catch-all domains are ordinary businesses whose server was configured that way on purpose, and mail to a real person there arrives normally. It is a reason to treat the address as unconfirmed, not a reason to discard it.
Where a probe ran and left mailbox_exists null, mailbox_confidence carries a recomputable 0–100 estimate that this particular mailbox exists, built from the domain's mail authentication, its registration age, the shape of the local part and, once a domain has five or more reported delivery outcomes, the share of them that bounced. It is a published heuristic, not a probe, and the page that lists its inputs says so.