Catch-All Domain Detection: MailValid API vs ZeroBounce vs NeverBounce (2026)

Catch-All Domains Are Sabotaging Your Email Deliverability

Your campaign dashboard shows 98% delivery. Your reply rate is near zero. Something doesn't add up.

The culprit is likely catch-all domains — mail servers configured to accept every email sent to them, regardless of whether the specific mailbox exists. Your ESP marks these as "delivered," but the emails vanish into the void. No opens. No clicks. No bounces. Just silent failure.

Detect catch-all domains before you send → Get 100 free MailValid credits

For cold email teams, newsletter operators, and SaaS companies, catch-all domains represent one of the biggest hidden threats to sender reputation. This guide explains exactly how catch-all servers work, why standard verification misses them, and how MailValid's email verification API detects them for $0.001 per email — 8x cheaper than ZeroBounce.

What Is a Catch-All Domain?

A catch-all domain is configured to accept email for any address at that domain, even if the specific mailbox doesn't exist. When an email arrives, the server accepts it during the SMTP handshake — then either drops it silently, forwards it to a central mailbox, or generates an auto-reply.

Real-World Examples

Domain Type	Catch-All Behavior	Common At
Large enterprises	Accept all, route to admin	Fortune 500, banks
Universities	Accept all, forward to IT	.edu domains
Government	Accept all, filter centrally	.gov domains
Small businesses	Accept all, owner checks periodically	Family-owned companies
Defunct companies	Accept all, no one reads	Acquired/shutdown firms

Why ESPs Love Catch-Alls (And Senders Hate Them)

Email service providers (Gmail, Outlook, Yahoo) use engagement signals to rank sender quality. When you send to catch-all domains:

1. The email is "delivered" — so your bounce rate looks healthy
2. No human ever opens it — so engagement is zero
3. ESPs interpret zero engagement as low-quality sending
4. Your future emails to real addresses start landing in spam

Catch-all domains are reputation poison disguised as successful delivery.

Why Standard Email Verification Fails on Catch-Alls

Most basic verification tools use one of three methods. Only the third catches catch-alls.

Method 1: Syntax Validation (Worthless for Catch-Alls)

Regex checks whether the email looks valid. [email protected] passes. But on a catch-all domain, every syntactically valid address passes — even [email protected].

Accuracy against catch-alls: 0%

Method 2: MX Record Lookup (Also Worthless)

MX checks confirm the domain has a mail server. Catch-all domains have perfectly valid MX records. This test tells you the domain accepts mail — which is true, but useless for mailbox-specific verification.

Accuracy against catch-alls: 0%

Method 3: SMTP Handshake with Randomized Probing (The Only Fix)

True catch-all detection requires an extra step during SMTP verification:

1. Connect to the mail server
2. Attempt delivery to the target address
3. Also attempt delivery to a guaranteed-nonexistent address at the same domain (e.g., [email protected])
4. If the server accepts both, the domain is catch-all
5. If the server rejects the random address but accepts the target, the target is likely real

This randomized probing is the only reliable detection method — and it's built into MailValid's verification API.

How MailValid Detects Catch-All Domains

MailValid performs deep SMTP verification on every request, including catch-all probing. Here's what the API returns:

Python: Detect Catch-All with MailValid

import requests

API_KEY = "your_mailvalid_api_key"

def check_catch_all(email):
    resp = requests.get(
        f"https://api.mailvalid.io/v1/verify?email={email}",
        headers={"Authorization": f"Bearer {API_KEY}"}
    )
    result = resp.json()

    if result.get("catch_all"):
        return {
            "safe_to_send": False,
            "reason": "Catch-all domain detected",
            "risk": "HIGH",
            "details": result
        }

    if result.get("valid") and not result.get("disposable"):
        return {
            "safe_to_send": True,
            "reason": "Verified real mailbox",
            "risk": "LOW",
            "details": result
        }

    return {
        "safe_to_send": False,
        "reason": result.get("reason", "Invalid"),
        "risk": "HIGH",
        "details": result
    }

# Test addresses
test_emails = [
    "[email protected]",
    "[email protected]",
    "[email protected]"
]

for email in test_emails:
    result = check_catch_all(email)
    print(f"{email}: {result['risk']} — {result['reason']}")

Sample API Response

{
  "email": "[email protected]",
  "valid": true,
  "reason": "success",
  "disposable": false,
  "role_based": false,
  "catch_all": true,
  "domain": "enterprise.com",
  "mx_record": "mx.enterprise.com",
  "smtp_verified": true
}

Notice: valid: true but catch_all: true. A naive tool would tell you to send. MailValid tells you the truth: this domain accepts everything.

JavaScript: Real-Time Catch-All Detection

async function verifyBeforeSend(email) {
  const response = await fetch(
    `https://api.mailvalid.io/v1/verify?email=${encodeURIComponent(email)}`,
    { headers: { 'Authorization': 'Bearer YOUR_API_KEY' } }
  );
  const data = await response.json();

  // Block catch-all domains for cold outreach
  if (data.catch_all) {
    return { 
      send: false, 
      reason: 'Catch-all domain — high risk of silent failure',
      flag: 'catch_all'
    };
  }

  if (!data.valid || data.disposable) {
    return { send: false, reason: data.reason, flag: 'invalid' };
  }

  return { send: true, flag: 'verified' };
}

const check = await verifyBeforeSend('[email protected]');
console.log(check.send ? '✅ Safe to send' : `❌ Blocked: ${check.reason}`);

MailValid vs ZeroBounce vs NeverBounce: Catch-All Detection

Feature	MailValid	ZeroBounce	NeverBounce
Catch-all detection	✅ Yes	✅ Yes	✅ Yes
SMTP randomized probing	✅ Yes	✅ Yes	✅ Yes
API response speed	<200ms	<300ms	<300ms
Price per check	$0.001	$0.008	$0.007
Free tier	100/day	100 one-time	1,000 one-time
Monthly minimum	None	$50	$40

All three providers detect catch-alls using the same randomized SMTP probing technique. MailValid delivers identical accuracy at 7-8x lower cost with no monthly minimums.

The Business Impact of Catch-All Domains

Still not convinced catch-alls matter? Here's what they cost you:

Wasted Send Volume

A typical B2B list contains 15-25% catch-all domains (enterprises, .edu, .gov). On a 50,000-email campaign: - Wasted sends: 7,500-12,500 emails - Cost at MailValid: $7.50-$12.50 to detect and remove - Cost of sending to dead addresses: Lower deliverability, domain reputation damage

Inflated Metrics

Catch-alls make your campaign look healthier than it is:

Metric	With Catch-Alls	After Removing Catch-Alls
Delivery rate	97%	85% (honest)
Open rate	15%	28% (real)
Reply rate	0.8%	2.1% (real)
Cost per reply	$125	$48

Removing catch-alls makes your metrics look "worse" on paper but dramatically better in reality. You're no longer paying to send emails to voids.

Reputation Decay

ESPs track engagement per domain over time. Sending 10,000 emails to catch-alls with zero engagement signals that you're a low-quality sender. Even your legitimate emails to real mailboxes start landing in spam.

Recovery time after cleaning: 2-4 weeks of consistent, verified sending.

How to Handle Catch-All Domains in Your Workflow

Option 1: Exclude Entirely (Recommended for Cold Email)

For cold outreach, the safest approach is removing catch-all domains entirely. Yes, you lose some potential real addresses at those domains. But you protect your domain reputation — which is worth far more than a few extra sends.

Option 2: Separate Low-Volume Sequence

For newsletter or transactional senders, create a separate sequence for catch-all domains: - Send at 10% of your normal volume - Monitor opens and clicks aggressively - If zero engagement after 3 sends, suppress the domain permanently

Option 3: Domain-Level Targeting

Use MailValid's API to build a "safe domain" whitelist. Only send to domains where you've personally verified at least one real mailbox exists.

# Build safe domain list
safe_domains = set()
risky_domains = set()

for email in email_list:
    result = verify_email(email)
    domain = email.split('@')[1]

    if result['valid'] and not result['catch_all']:
        safe_domains.add(domain)
    elif result['catch_all']:
        risky_domains.add(domain)

print(f"Safe domains: {len(safe_domains)}")
print(f"Catch-all domains removed: {len(risky_domains)}")

FAQ: Catch-All Domain Detection

Are catch-all domains always bad?

Not always. For transactional emails (receipts, password resets), catch-alls ensure delivery even if the user typo'd their address. For marketing and cold email, they're dangerous because they create false deliverability signals.

Can I detect catch-alls without an API?

Technically yes, but it's unreliable. You'd need to script SMTP connections, generate randomized addresses, and interpret server responses — all while managing rate limits and blacklisting risks. MailValid handles this for $0.001 per check.

Does MailValid charge extra for catch-all detection?

No. Catch-all detection is included in every verification at the standard $0.001 price.

What percentage of domains are catch-all?

B2B lists: 15-25%. Consumer lists: 5-10%. Government/academic: 30-40%.

Can I try MailValid for free?

Yes — 100 free verification credits per day. Sign up here →

Don't Let Catch-Alls Hide Your Real Performance

Catch-all domains are the dirty secret of email deliverability. They make your campaigns look successful while silently eroding your sender reputation. The only solution is detection at the point of verification — before the email ever leaves your server.

MailValid detects catch-all domains using the same deep SMTP probing as enterprise providers, but at $0.001 per email with 100 free daily credits. That's not just cheaper — it's the difference between honest metrics and vanity metrics.

Get 100 free credits and audit your list for catch-alls today →

See how MailValid pricing compares to ZeroBounce and NeverBounce →