Catch-All Email Spam Risk: Why the Default Should Be Reject

A catch-all email address accepts mail for every name on your domain, and that is exactly the spam risk: once the domain is under a catch-all, every guessed address, sales153@, invoice2024@, admin@, becomes a delivered message. The volume is not theoretical; spammers run dictionary attacks against domains precisely because catch-alls make them profitable. The safer default is the opposite: unknown addresses bounce, and the addresses you actually want are created as aliases. You keep the flexibility and lose the firehose.

We make SuperMailOS, where every domain starts with chosen aliases and unknown addresses bounce by default, so our bias is on the table. The mechanics below apply to any mail setup.

How catch-all spam actually arrives

Three mechanisms, in the order operators meet them:

1. Dictionary attacks. Spammers generate plausible usernames against your domain. With a catch-all, all of it delivers. Without one, nearly all of it bounces at the door.
2. Database leaks. Your address was tom@ at signup in 2019; the leak sells it as tom@, tom.smith@, tom2028@ variants to whoever concatenates next.
3. Your own history. Every newsletter, every forum, every PDF you published with contact@ on it. A catch-all turns each forgotten variant into a live inbox forever.

The compounding part is that responding is worse than receiving: any interaction, including unsubscribing from mail you never subscribed to, confirms a human reads the box.

The hidden cost: backscatter and reputation

A catch-all has a second-order effect most people meet only after it hurts. When your server accepts everything, it also accepts mail to addresses that would otherwise have been rejected during the SMTP conversation. If that mail then bounces internally, or gets auto-answered, your domain starts emitting backscatter: bounces for mail you never accepted responsibility for. Backscatter gets your outbound mail treated more cautiously by the receivers that notice it, which is a price you pay for spam you did not want in the first place.

The fix: default-closed plus aliases

The pattern that works is a small inversion of the catch-all:

• Unknown addresses reject. The SMTP conversation fails at RCPT, so dictionary spray costs the sender, not you.
• Real addresses are aliases. hello@, support@, billing@ deliver into the mailbox you actually read. Creating one takes seconds and removes it again just as fast, which matters when an alias starts leaking: kill the alias, keep the addressable domain.
• A quarantine reviews the borderline. If you truly fear losing mail addressed to a name you forgot you used, quarantine unknown recipients for a fortnight rather than delivering them.

In SuperMailOS this is the native shape: add a domain, tap the addresses you want, every one of them delivers into one inbox, and unknown names bounce. The pricing page keeps aliases free and unlimited on every plan, which is the economic expression of the same idea: addresses are cheap, which means you can afford to be selective. The same default-closed shape runs across every scenario on the use cases page.

When a catch-all is still the right call

Honesty time: some setups genuinely need one. A domain whose users mail each other with unpredictable local parts, a legacy migration where you cannot enumerate the old addresses, or a regulatory mailbox that must not miss a variant. In those cases, run the catch-all with aggressive filtering, quarantine for unknowns, and a periodic audit of what the catch-all actually caught. Most operators who audit find three messages they wanted and three thousand they did not.

Reading the risk on your own domain

If you run a catch-all today, measure before deciding. Count the messages delivered to addresses you never created in the last 30 days. That number, plus a glance at whether any of them was real mail you needed, is the whole decision. The conceptual comparison between the two patterns is in catch-all vs email aliases; the portfolio-scale version, where this multiplies across every product domain you own, is covered in email hosting for multiple domains, and the agency angle in our agencies guide.

Frequently asked questions

Does a catch-all increase spam?

Yes, and immediately. A catch-all domain accepts dictionary attacks instead of bouncing them, so spray campaigns that cost spammers nothing against you keep coming. It compounds over time as leaks and lists accumulate.

Is it better to bounce or reject unknown mail?

Reject during the SMTP conversation. A bounce after acceptance creates backscatter, which other receivers read as a signal about your domain. A rejection at the door is the sender's problem, not yours.

Can I keep the flexibility without the catch-all?

Yes, that is the alias pattern: create the addresses you want on demand, delete any that start attracting abuse. You get coverage for every name you actually use, without accepting the infinite tail of names you do not.

How do I migrate off an existing catch-all?

Audit what it caught for a month, turn the real correspondents into aliases, then close the catch-all. Watch the quarantine for two weeks afterward for anything the audit missed.