What Is a Catch-All Email?

A catch-all email is an address on a domain whose mail server accepts mail for any name before the @. Real mailbox or typo, the server says yes.

That makes the address unprovable, not bad. This page defines it, shows how a verifier spots one, and tells you how to handle it in outbound.

Key takeaways

• A catch-all domain accepts every recipient, so a probe cannot confirm that one mailbox exists.
• The verdict is "cannot confirm", which sits between verified and invalid.
• Send catch-all addresses in their own smaller batch and watch the bounce rate.
• On LeadOcean the filter is emailStatus, and counting by status is free.

What it is

A catch-all email is an address on a domain set to accept mail for every possible recipient, so the server cannot say whether that mailbox exists.

It is a server setting, not a kind of address. The SMTP standard defines how a server answers the RCPT TO command: a 250 means accepted, and a 550 means the mailbox is not available (RFC 5321, September 2026). A catch-all admin answers 250 to everything.

Admins do it so mail is never lost to a typo. The cost lands on senders, who lose their cheapest signal.

You will also see "accept-all" and "accept all". Same behavior, different label.

A small team may have no IT admin to turn it off. A larger company may want every misaddressed message to land in one shared inbox, where someone sorts it.

How it works

A verifier asks the mail server about a recipient, then disconnects before sending any message. A normal domain answers honestly. A catch-all domain does not.

1. The verifier connects to the domain's mail server and sends RCPT TO for the address you want to check.
2. The server replies 250 or 550.
3. The verifier sends a second RCPT TO for a random name that cannot exist.
4. If the random name also gets a 250, the domain accepts everything.
5. Every address on that domain is labelled catch-all, including the real ones.

Worked example, with placeholders:

RCPT TO:<jane.doe@acme.com>       -> 250 OK
RCPT TO:<zq81xk-probe@acme.com>   -> 250 OK

Both lines say yes, so acme.com is a catch-all domain. jane.doe@acme.com looks like a good address, but nothing has confirmed it. If the mailbox is missing, the bounce arrives after you send.

Catch-all vs risky, unknown and invalid

People lump every non-verified label together. They are different outcomes with different send rules, and tools do not all use the words the same way.

The key difference is cause. Catch-all comes from the domain's setup. Risky and unknown come from the address or the check itself.

That matters when you debug a bad campaign. If bounces cluster on one domain, look at the domain. If they spread across many domains, look at your list source and your verification step.

LeadOcean also has catch_all_valid. It marks a mailbox on a catch-all domain whose existence was confirmed through the provider's identity check. That covers Microsoft 365 managed tenants and Google Workspace only (LeadOcean API enums, September 2026). It ranks between verified and catch_all.

When it matters

Cold outbound to small companies

Small companies are often your best fit, and some of them run catch-all domains. Check the catch-all share of the list before you send. Do not drop it. Split it out and send it at lower volume.

Protecting your sending domain

A mailbox that does not exist bounces after you sent, and mailbox providers count it against your domain. Bounces cost you reputation faster than they cost you leads. LeadOcean does not refund bounced emails, so reading the status before you send is your protection.

Sizing a list before you pay

Two lists can look identical until you read the status. On 2026-10-01, leadocean_count_leads returned 92,392,601 people with emailStatus set to catch_all and 32,393,985 with emailStatus set to verified. Both are worldwide counts with no other filters, and they are counts by email status, not mailable counts. The catch_all filter also matches catch_all_valid.

Deciding how much risk a campaign can take

A warm-up campaign to a small, careful list can skip catch-all addresses entirely. A volume campaign to a wide market may not be able to, if the catch-all share of the list is large. Pick the rule before you pull the list, not after the first bounce report.

A simple rule works for most teams. Send verified and catch_all_valid first. Send catch_all second, at a fraction of the daily volume. Leave risky and derived for last, if at all.

Paying twice for the same check

A second verifier rarely changes the answer on a catch-all domain. The domain still says yes to everything, so the second probe has the same blind spot. Spend your verification budget on the unknown and risky groups instead.

How LeadOcean handles it

Every people search row carries email_status, email_type and has_email as flags, so you see the status before you buy the address. The emailStatus filter takes the values from GET /v1/enums/email_status. Sizing is free: send count=true as a query parameter with limit=1 (LeadOcean OpenAPI, September 2026).

Passing emailStatus replaces the default filter, which is verified, catch_all_valid and catch_all. So you choose what to send. Treat a verified count from search as an upper bound and confirm it per address on enrichment.

The first call below sizes catch-all VPs in the US and spends no records. The second pulls the verified group, and each person returned counts one record.

curl -X POST "https://api.leadocean.io/v1/people/search?count=true&limit=1" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"emailStatus": ["catch_all"], "jobLevel": ["VP"], "country": ["US"]}'

curl -X POST "https://api.leadocean.io/v1/people/search" \
  -H "x-api-key: $LEADOCEAN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"emailStatus": ["verified"], "jobLevel": ["VP"], "country": ["US"], "limit": 25}'

Pull verified first and catch_all second, then send them as two campaigns. The same filter works in the MCP server through leadocean_count_leads and leadocean_search_leads. It also works on the Exports page of the app (app.leadocean.io), which shows the record price before you start.

Pricing is two plans: Free (1,000 records, one-off, no card) and Pro at $499 a month. See pricing.

FAQ