Catch-All Checker

01 what a catch-all domain actually is

A catch-all — or accept-all — domain is a mail server configured to accept mail addressed to anything at the domain. jane@acme.com, sales@acme.com, kjh3f98s@acme.com: the server takes them all and sorts it out later. Admins set this up so typos and legacy addresses don't bounce, mail routed through migrations doesn't get lost, and security teams can trap phishing probes in a quarantine box.

It's a perfectly reasonable server configuration. It's also the single biggest blind spot in email verification, because the standard verification technique relies entirely on the server rejecting bad recipients. Catch-all servers never reject anyone — which is exactly the problem.

02 why every verifier says "risky"

Standard SMTP verification works like this: resolve the domain's MX records, open a connection to the mail server, and walk the start of a delivery — EHLO, MAIL FROM, RCPT TO — then hang up before sending anything. The server's reply to RCPT TO is the verdict: 250 means the mailbox exists, 550 means it doesn't.

> RCPT TO:<jane@acme.com>
< 250 2.1.5 Recipient OK
> RCPT TO:<zk49qwfx@acme.com>
< 250 2.1.5 Recipient OK      ← catch-all. the handshake tells you nothing.

On a catch-all domain, the server answers 250 to every recipient — including addresses that were invented a second ago. The handshake carries zero information about whether your specific mailbox is real. An honest tool has to admit that, so it stamps the address risky or accept-all, charges you a credit, and moves on. Catch-all configurations are common across B2B domains, so on a typical prospect list a painful slice of your spend comes back as a shrug.

03 how we resolve the mailbox anyway

The SMTP front door is a dead end on catch-all domains, so we stop asking it. Most custom-domain business mail is hosted on one of two platforms — Microsoft 365 or Google Workspace — and both expose identity infrastructure that knows which accounts actually exist:

• Microsoft 365: we identify the domain's tenant and probe Microsoft's own identity endpoints to determine whether the address corresponds to a real account in that tenant.
• Google Workspace: we run equivalent probes against Google's account infrastructure to confirm the mailbox identity exists.

These checks are independent of the catch-all configuration, so a result that any other tool returns as risky collapses into a definitive deliverable or undeliverable. When a catch-all domain sits on a host we can't probe, we say so honestly — and unknown results are never charged.

syntax ──→ mx lookup ──→ smtp handshake
                              │
                              ├── 550 ───────────────────→ undeliverable
                              ├── 250, not catch-all ────→ deliverable
                              └── 250, catch-all detected
                                       │
                                       ├── microsoft 365 ──→ tenant identity probe ──→ verdict
                                       ├── google workspace → account probe ─────────→ verdict
                                       └── other host ─────→ risky / unknown (not charged)

04 the rest of the stack

05 pricing

1 credit = 1 verification. Sign up free and get 100 free credits — no card required. Single-check unknowns are never charged; bulk unknowns are refunded automatically.

create free account → 100 credits

06 faq