How SimpleVerifier grades catch-all addresses
A catch-all domain accepts every address, so no mailbox there can be confirmed by asking the server. We keep those rows risky and grade each one higher, medium or lower likelihood, with the reasons. A grade is never a confirmation.
Written by the SimpleVerifier Team. The grading opens no extra mail connection.
What you get on a catch-all row
catch_all_confidence: higher, medium or lower likelihood that the mailbox is real.catch_all_reasons: plain sentences, for example “Same first.last format as 3 confirmed addresses on this domain in this list”. Every row ends with “Still unconfirmed”.catch_all_signals: stable codes for filtering, such asmatches_confirmed_formatorname_guess_variants. They are in the CSV, the API and the MCP server.statusstaysriskyandsend_advicestayscare. Existing fields did not change.
The safe-to-send download has three choices: confirmed only (the default), confirmed plus higher-likelihood catch-alls (filter=safe_likely), or confirmed plus every catch-all except lower likelihood (filter=safe_not_lower).
How the grade is worked out
Each catch-all row starts at medium. Evidence for the address moves it up, evidence against moves it down, and some signals set it to lower outright:
| Signal | Effect |
|---|---|
| Same name format as confirmed addresses on the domain (first.last next to a confirmed first.last) | Raises the grade (+2) |
| Same format as at least 80% of the other addresses on that domain in the list (5 or more) | Raises the grade (+1) |
| Single-word name (anna@) next to confirmed single-word addresses | Raises the grade (+1) |
| A different name format from the domain's settled confirmed format | Lowers the grade (−2) |
| Two or more other spellings of the same name on the domain in the list (anna.lee, a.lee, alee...) | Grade set to lower |
| Placeholder address that nobody reads (test@, noreply@) or a disposable domain | Grade set to lower |
Limits
- We assume a person’s address format works the same way on a catch-all domain as on one that answers. We cannot check that without bounce data, and we hold none.
- The grade depends on the list. A list of real contacts is mostly real whatever the grade, so the grades separate little there.
- Most catch-all rows carry no evidence either way and stay medium. Evidence appears when the same list or our recent checks hold confirmed addresses on the domain, or when a list holds guessed spellings.
- The figures are not a deliverability promise and not a per-row probability.
Signals we tested and do not use
| Signal | What we found | Decision |
|---|---|---|
| Mail host (Google Workspace, Microsoft 365, Proofpoint and other gateways) | Where a domain's mail is hosted says nothing about whether one particular address on it is real. | Shown as context only |
| SPF and DMARC records | These describe how a domain sends mail, not which mailboxes it has. | Not used |
| The exact address is published on the domain's own website | Strong evidence when it happens, but few catch-all addresses are published anywhere. | Too rare to build yet |
| How fast the server answers RCPT for a real versus a random address | Gaps between a real and a random address were small or explained by special addresses, and Microsoft 365 answers only the first recipient per connection. | Not used |
| Domain age | We hold no WHOIS data, so we cannot measure it. | Not used |
| Random-looking or placeholder names | Shared addresses such as mail@ and email@ are usually real, so they are not treated as placeholders. test@ and noreply@ stay lower because nobody reads them. | Context only, except test@/noreply@ |
A domain is only labelled catch-all after a random address we generate is accepted.
How other verifiers describe catch-alls
From their public documentation, read on 24 October 2026:
| Verifier | What the docs say | Source |
|---|---|---|
| ZeroBounce | Status catch-all. Addresses on its own accept-all list can come back valid with sub-status accept_all. A separate AI score (0 to 10) is sold for catch-alls, built from data it does not name. | docs |
| NeverBounce | Result catchall ("accept all / unverifiable"). No score on its verify reply. | docs |
| Bouncer | Status risky with reason low_deliverability and domain.acceptAll, plus a 0 to 100 score. Its docs do not explain how the score is computed. | docs |
| Hunter | Status accept_all with a score. Its docs do not say how the score is computed. | docs |
| MillionVerifier | Says it resolves part of catch-alls into valid or invalid with a proprietary method. Unresolved ones are risky. | docs |
We publish our signals and the ones we do not use. Higher means we found evidence for the address. It does not mean confirmed, so we never call it valid.
Common questions
- Can any verifier confirm an address on a catch-all domain?
- Not by asking the mail server, because the server says yes to every address, real or made up. A verifier that marks a catch-all address valid is using some other evidence. SimpleVerifier keeps these rows risky and grades them higher, medium or lower likelihood with the reasons.
- How is the catch-all grade worked out?
- From evidence already in the list and the domain: whether the name format matches confirmed addresses on the same domain, whether the list holds several spellings of one name, the format of the rest of the list, and placeholder and disposable flags. It opens no extra mail connection. In a list where nearly every address is real, the grade separates little.
- Which signals did not work?
- The mail host (Google Workspace, Microsoft 365, gateways), SPF and DMARC records, and RCPT response timing say nothing about whether one particular mailbox exists, so they do not move the grade. Domain age is not used because we hold no WHOIS data.
- Should I send to catch-all addresses?
- Send higher-likelihood rows first, in small batches, and watch bounces. Drop lower-likelihood rows: most are guessed spellings of a name. The safe-to-send download lets you choose confirmed only, confirmed plus higher, or confirmed plus everything except lower.
See also: how a check works, catch-all checker, API docs, catch-all email verification: plans and what vendors charge.