How to Set Up a Catch-All Email Address

A catch-all address receives mail sent to *any* address at your domain — hello@, typo@, randomstuff@ — even addresses you never created. It's handy for never missing a message and for giving out disposable per-service addresses. But it has real downsides worth understanding first. This guide shows how to set one up and when not to.

What a catch-all does

Normally, mail to a non-existent address (salez@example.com when only sales@ exists) bounces. A catch-all changes that: anything not matching a real mailbox or alias gets delivered to one designated inbox. You effectively own *every* address at your domain at once. It's the email cousin of wildcard DNS and catch-all subdomains.

Step 1: Set it up on your provider

The catch-all is configured on your mail host, not in DNS — your MX records already route mail to that host. The exact toggle depends on the provider:

• Google Workspace: Admin console → Apps → Gmail → Routing, add a routing rule for "unrecognized addresses" delivering to a chosen mailbox.
• Cloudflare Email Routing: enable Catch-all address and set the destination.
• Self-hosted (Postfix): map the domain's unmatched addresses to a mailbox with a virtual alias:

# /etc/postfix/virtual
@example.com    catchall@example.com

Then rebuild and reload:

postmap /etc/postfix/virtual
systemctl reload postfix

For the broader mailbox setup this sits on top of, see how to set up business email on a custom domain.

Step 2: Verify it works

Send a test to a made-up address at your domain (test-catchall-123@example.com) and confirm it lands in the catch-all inbox. Also confirm your real addresses still deliver to their own mailboxes — explicit mailboxes and aliases should always take precedence over the catch-all.

The big downside: spam

Here's why many admins avoid catch-alls: spammers send to dictionary lists of guessed addresses (info@, admin@, john@, sales@…). A catch-all accepts all of it, so your one inbox drowns in junk that would otherwise have bounced. It can also feed backscatter and make your domain a more attractive spam target. Strong filtering and the authentication in how to set up SPF, DKIM and DMARC step by step help, but the volume is real.

Smarter alternatives

• Explicit aliases: create just the addresses you use (hello@, support@, billing@) as aliases to one inbox. You get the convenience without accepting mail to random addresses.
• Plus-addressing: you+shopname@example.com already routes to you@ on most providers — great for per-service tagging without a catch-all.
• Forwarding a few known addresses: if you just want mail in Gmail, see how to forward custom domain email to Gmail.

For most people, a handful of explicit aliases beats a catch-all: same convenience, far less spam.

Taming catch-all spam

If you do run a catch-all, a few habits keep the inbox usable:

• Aggressive spam filtering on the destination mailbox — Gmail's and Outlook's filters handle a lot, but tune them.
• Server-side rules that file mail sent to obviously fake addresses (long random strings) straight into a low-priority folder.
• Authentication first. Publishing SPF, DKIM and DMARC — how to set up SPF, DKIM and DMARC step by step — won't stop inbound spam, but it stops spammers *spoofing* your domain, which reduces the backscatter a catch-all otherwise attracts.
• Rotate a burner catch-all if one gets scraped and buried — though at that point explicit aliases are the better answer.

Per-service addressing without a catch-all

A big reason people reach for a catch-all is handing out a unique address per signup so they can see who leaked their email. You get that *without* a catch-all using plus-addressing, which works out of the box on Gmail, Google Workspace and most modern servers:

you+netflix@example.com
you+bank@example.com
you+randomshop@example.com

All deliver to you@example.com, and you can filter or block any tag that starts getting spam — the same benefit as a catch-all with none of the dictionary-spam downside.

Audit what your catch-all receives

If you inherit a domain with a catch-all already on, spend ten minutes auditing it before deciding to keep it. Sort a month of mail by recipient address and you'll usually find: a handful of real role addresses worth turning into explicit aliases, and a long tail of junk sent to guessed names. Convert the real ones to aliases, then decide whether the catch-all still earns its place — for most domains it doesn't. If you just want a couple of addresses reaching your normal inbox, plain forwarding is cleaner: how to forward custom domain email to Gmail.

FAQ

Is a catch-all a DNS setting?

No. Your MX records route all mail to your host; the catch-all rule lives on that mail host (Google, Cloudflare, Postfix), deciding what happens to unmatched addresses.

Will a catch-all increase my spam?

Yes, usually a lot. It accepts mail to every guessed address instead of bouncing it, so dictionary spam all lands in one inbox. Good filtering mitigates but doesn't eliminate this.

Do real mailboxes still work with a catch-all on?

Yes. Explicit mailboxes and aliases take precedence; only addresses that match nothing fall through to the catch-all.

What's a good alternative to a catch-all?

Explicit aliases for the addresses you actually use, plus plus-addressing (you+tag@) for per-service tagging. You get flexibility without the spam flood.

Does a catch-all address affect my email deliverability?

Indirectly, yes. A catch-all itself doesn't change how your *outbound* mail is judged, but it can harm your domain's reputation over time. By accepting mail to every guessed address instead of bouncing it, a catch-all makes your domain a soft target: spammers learn that anything@yourdomain is accepted, so they send more, and the flood of junk into one inbox raises the odds of a real message being missed. It can also generate backscatter if the catch-all auto-replies or forwards. None of this blocks your sending directly, but a domain known to swallow everything tends to attract more abuse. Tight spam filtering, DMARC to stop spoofing, and preferring explicit aliases over a broad catch-all all keep the reputation impact minimal.

Whether you want a catch-all, aliases or full mailboxes, it's easy on managed Nxeon business email — or run your own rules on a fast VPS with root access.