A catch-all domain accepts mail addressed to any username at it, whether or not that address was ever created. Send something to anything-at-all@yourdomain.com and it arrives. That's what lets an alias exist the instant you invent it at a signup form. The cost is that the domain also accepts addresses you never invented — including guessed ones — until you individually switch them off.
How it differs from a normal mailbox
Ordinarily a mail server has a list of valid addresses and rejects anything not on it. Mail to a typo bounces, which is useful — the sender learns immediately that they got it wrong.
A catch-all inverts the default. Every address at the domain is valid until told otherwise. Nothing bounces, nothing needs creating, and the mail server stops being a gatekeeper and becomes a router.
Why this is the feature that makes aliases practical
Without catch-all, every alias needs creating before use. In practice that means a browser extension, an app, or a detour to a web dashboard mid-signup — and the friction is exactly where the habit breaks down. People fall back to their real address because generating an alias was three steps and they were in a hurry.
With catch-all, the alias is the act of typing it. You're on a checkout page, you type hardware-store@yourdomain.com, and it works. Nothing to install, nothing to remember, no context switch.
That's why it's the default mode for Don't SPAM Me: the alias is created automatically the first time mail arrives for it. SimpleLogin Premium and other custom-domain services support catch-all too, generally as an option rather than the default.
The real downside
Because every address is valid, a spammer can send to info@, admin@, sales@, john@, contact@ and a few thousand other guesses at your domain, and all of them will be accepted. On a normal domain, those bounce instantly.
How much this matters depends on your domain. An unremarkable domain that nobody has reason to target sees very little of this. A domain that looks like a business, or one that's been published anywhere, sees more.
The mitigation is straightforward but it is reactive: when junk arrives at an address you never issued, disable that address. It stops. But you are responding after the fact rather than preventing it.
Two secondary effects worth knowing
- Typos silently succeed. If someone mistypes your alias, the mail arrives at a slightly different address rather than bouncing. Usually harmless, occasionally confusing.
- Backscatter. If a spammer forges your domain as the sender on a campaign, bounce messages can come back to it. A catch-all accepts them all. Proper SPF and DMARC records reduce this considerably, and any competent service sets those up during onboarding.
Catch-all versus subdomain aliases
Firefox Relay Premium takes a different route to the same convenience: you get a subdomain, and any word before the @ works — shop@yourname.mozmail.com. Same on-the-fly creation, and the guessing problem is contained to your subdomain rather than a domain you own.
The trade-off is the one that runs through this whole subject: the subdomain sits inside Mozilla's domain, so the addresses depend on Relay continuing. A catch-all on your own domain doesn't. The comparison in full.
Should you turn it on?
| Situation | Verdict |
|---|---|
| Personal domain, not published anywhere, used for per-service aliases | Yes. The convenience is the whole point and the risk is low. |
| You want addresses that exist the moment you type them | Yes. There's no other way to get that. |
| Business domain with published contact addresses | Be careful. Published domains attract guessing; consider explicit aliases instead. |
| You've had a dictionary attack already | Reconsider. Explicit aliases, or a subdomain for the catch-all. |
| You want zero unsolicited mail ever reaching the server | No. Explicit aliases only. Accept the friction. |
Naming, given all this
Readable names like netflix@ are guessable by anyone who has seen one of your addresses. For most people that's a fair trade — the resulting junk is trivially attributable and one tap from being switched off, and readable names are what make the whole system usable day to day.
If you'd rather not be guessable, add a short fixed suffix you reuse everywhere: netflix-k2@, amazon-k2@. Still readable to you, not derivable from a single sample. More on naming conventions.
More: email aliases explained · what disabling an alias does