Accept-all domain: what it is and why it causes problems for email senders

An accept-all domain (also called catch-all) is one whose mail server accepts incoming messages to any address at that domain, including addresses that do not exist. Send a message to abcdef12345@that-domain.com and the server replies with "OK, accepted." The mailbox abcdef12345 is not real, but the server will not reject the message.

How it works technically

A standard mail server checks the RCPT TO command during the SMTP handshake. If the recipient exists, it responds with 250 OK. If the recipient does not exist, it responds with 550 User unknown. This lets a validator determine whether a specific mailbox is alive.

An accept-all server responds with 250 OK to every RCPT TO. The validator asks: "Will you accept mail for test123@domain.com?" The server says yes. "How about xyzrandom@domain.com?" Yes again. There is no way to distinguish a real mailbox from a nonexistent one through SMTP alone.

The configuration is set at the MTA (Mail Transfer Agent) level. In Postfix it is the virtual_mailbox_maps directive or a catch-all alias. In Exchange, transport rules handle it. Administrators enable it deliberately, usually to avoid losing messages due to address typos.

Why companies enable accept-all

The main reason is fear of missing a message. A client sends an order to slaes@company.com instead of sales@company.com. Without accept-all the message bounces. With it, the message lands in a shared inbox and gets handled.

The second reason is setup simplicity. A small company routes everything to a single mailbox rather than creating a separate address for every employee. All mail arrives in one place; the owner sorts it by hand.

Some companies also use accept-all for marketing attribution: each acquisition channel gets its own address (promo@, webinar@, partner@) without anyone having to provision those mailboxes individually.

The problem for email validation

Accept-all is the primary headache for email validators. SMTP verification, which works reliably on standard servers, is useless here: the server says "yes" to everything, and the validator cannot tell whether a specific mailbox exists.

Validators detect accept-all configurations by sending an RCPT TO for a deliberately random address — something like qwerty-random-test-12345@domain.com. If the server responds 250 OK to that, it accepts anything, and the domain is flagged as accept-all. Every address at that domain is then marked "accept-all" or "unverifiable."

That does not mean all addresses on accept-all domains are bad. Real mailboxes belonging to real people exist among them. The validator just cannot separate them from nonexistent ones. The decision to send is yours.

Working with accept-all addresses in campaigns

Excluding accept-all addresses entirely is an overreaction: some of your best customers may be among them. Sending to them without any precautions is also a risk — a portion of those addresses do not exist and will produce bounces.

A practical approach: put accept-all addresses in a separate segment and monitor its bounce rate independently. If it stays below 2%, keep sending. If it climbs above that, narrow the segment to addresses with engagement history (opens, clicks) and suppress the rest.

If an address at an accept-all domain was collected through double opt-in, it is reliable: the person confirmed the subscription from that mailbox. The accept-all status stops being a concern in that case.

If the address came from a purchased list or a single opt-in form without validation, the risk is high. Those are better excluded or flagged for additional review.

How common is it

Estimates vary, but roughly 10 to 20% of corporate domains run accept-all configurations. Large consumer providers (Gmail, Outlook.com, Yahoo) do not use it, though they also do not return a direct SMTP signal about whether a mailbox exists.

In B2B lists the share of accept-all addresses can reach 25 to 30%, because corporate domains use this configuration far more than consumer ones. For B2C lists where Gmail and similar providers dominate, the problem is less pronounced.