Catch-all is a domain mail mode where the mailbox accepts a letter sent to any address on that domain, even one never created in advance. For a run of signups that looks tempting: no separate mailbox per site, just configure the domain once and invent addresses on the fly. But the convenience has a cost that shows up later, once the domain is already in use. Here is how it works, what it demands on your side, where it is weak, and when renting a ready-made mailbox is the smarter call instead.
What catch-all is, and why people set it up
An ordinary mailbox has one specific address, and a letter to any other address on the same domain gets rejected — that mailbox simply does not exist. Catch-all changes the rule at the domain level: the server is configured so a letter to any address on that domain, even one never created, still lands in one designated mailbox. A sender can write to anything shaped like "random-string@your-domain" and it still arrives, ending up in the same shared folder as everything else the domain receives. The appeal is saving setup time: instead of creating a separate mailbox per site in advance, the address is invented at signup — say, working the site's name into the string — and mail to it arrives with no setup at all. That pays off where addresses are many and disposable by design.
What it takes on your side — and it is administration
Catch-all's convenience is not free: it needs your own domain and a mail host that supports the setting, plus ongoing administration — DNS records, domain reputation, SPF and DKIM — so mail actually arrives without being flagged as spam. If anything in that chain breaks — registration lapses, a DNS record slips, the host blocks the box over suspicious activity — delivery fails at once across every address ever invented on the domain.
The downside: spam, compromise, and services that distrust it
Catch-all carries three structural downsides, all tracing back to one fact: a single mailbox is responsible for every address on the domain. First, all the spam that finds its way to the domain — address guessing, a leaked list, spam bots — lands in that one mailbox mixed in with mail you actually want. Second, and more serious: whoever gets access to that mailbox gets access to correspondence for every account ever registered through the domain — a compromise cannot be contained to one address. Third, reputational risk: some services distrust domains showing catch-all patterns or a thin history, and may block or flag a signup before the letter is sent.
Catch-all on your own domain vs. renting a ready-made mailbox
The platform works the other way around: you cannot connect your own domain — it's issued from a shared pool — but there is nothing to administer on your side. For a one-off task, a temporary mailbox can be issued for a specific site: it stays alive for 20 minutes, and if no letter arrives, the activation closes on timeout with an automatic refund. For longer work with an account, a mailbox can be rented for a term from 12 hours to 60 days with renewal supported. A rented mailbox comes with a built-in filter: it only accepts mail from sites named at order time, so the "everything piles into one box" problem is solved by design rather than left to whoever administers the domain. The difference between formats is covered in temporary email vs. a rented mailbox.
Who catch-all makes sense for, and who should just rent
Catch-all pays off if you already have a domain whose mail you administer anyway — adding catch-all then costs almost nothing extra. It's also justified when signups are large and unpredictable enough that preparing mailboxes in advance isn't practical, and mixed spam plus a single point of compromise is an accepted trade-off. Otherwise — no domain yet, no appetite to administer mail, or isolation between accounts matters — renting a ready-made mailbox with a site filter is simpler and safer: no DNS setup, no risk of losing everything at once, no reputation you personally answer for.
Frequently Asked Questions
Can catch-all be limited so it only accepts mail matching a pattern of addresses I actually need?
Some mail hosts allow finer filters layered on top of catch-all, but that's a separate setup requiring the same administration as the mode itself. Plain catch-all accepts everything on the domain.
What happens if a domain running catch-all gets compromised?
Access to the single mailbox means access to correspondence for every address that domain ever received mail on — including recovery letters for linked accounts. The incident cannot be contained to one address.
Why can't a mailbox rental on the platform use my own domain?
Domains are issued from the platform's pool — that trades your own domain's administration and reputational risk for a filter on named sites and nothing to configure on your side.
If administering your own domain for catch-all is not something you want to take on, a one-off activation for a specific site or a mailbox rental for the term you need is available in the email-OTP section.