A catch-all mail server accepts mail for every address in the domain. No address verification possible.
250 OK
RCPT TO:<doesntexist@company.com> 250 OK
RCPT TO:<notauser123@company.com> 250 OK ```
All three "verify" as 250 OK. But only the first one might be a real person.
A common response shape looks like: ``` { "email": "anything@company.com", "status": "verified" } ```
Your sales team ships this. Two weeks later, it bounces. Sender reputation takes a hit — and the CSV export from a month ago is still marked "verified."
A single undeliverable address damages your sending domain:
- **ISP bounce thresholds**: Gmail, Microsoft, Yahoo track bounce rates per sender. Exceed 5% and your mail goes to spam. - **Reputation scoring**: Services like Return Path (Validity) and SNDS (Hotmail/Outlook) monitor bounces and flag risky senders. - **DMARC/SPF/DKIM**: Authentication helps, but high bounces override auth. The ISP sees: "this domain sends mail to fake addresses."
Cost of a single wrong address? - At 100 emails: 1% loss of reputation - At 1,000 emails: ~0.1% direct impact, but compounds across campaigns - At 10,000 emails: Noticeable ISP filtering. One campaign with 50 bad addresses can hit spam folder for the next month.
Instead of binary verified/unverified, Coalstoke returns:
"email": "jane.doe@company.com", "status": "catch_all", "pattern_guess": "jane.doe@company.com", "confidence": 0.72, "note": "Domain accepts all mail. Returning top-ranked pattern guess." }
- **status: catch_all** - The domain doesn't reject mail. Could be anyone. - **pattern_guess** - Based on examples we've seen, this is the most likely real address format. - **confidence: 0.72** - We're 72% confident this is right. Use at your own risk.
For catch-all domains, Coalstoke's pattern engine learns from every successful lookup: - If you find jane.smith@company.com once, we learn `first.last` is their format. - Next lookup for john.adams@company.com uses the same pattern, scoring confidence 0.72+. - As more data comes in, patterns get refined. Confidence improves.
1. **Research mode**: You're building a list and plan manual review. Low false positive cost. 2. **High-volume discovery**: You're finding 100 addresses and can afford to retry 30 of them. Batch verification against your database later. 3. **Competitor intelligence**: You're researching org structure, not sending immediately.
When NOT to use: 1. **Cold email campaigns**: Every bad address hurts sender reputation. 2. **Mass outreach**: You can't manually review. Better to send fewer, verified emails. 3. **Reputation-sensitive verticals**: Finance, healthcare, government. One bounce = risk.
Coalstoke's confidence scoring on catch-all domains: - 0.90-1.0: Extremely confident (pattern seen 10+ times in domain) - 0.70-0.89: Confident (pattern established, small sample) - 0.50-0.69: Possible (multiple patterns observed, could be either) - Below 0.50: Guess (insufficient data, use with caution)
Real data from our platform: on catch-all domains with confidence above 0.75, downstream bounce rate is 3-5%. Below 0.50, it jumps to 15-20%.
1. Always ask for verified addresses only. Only ship status: `deliverable`. 2. For catch-alls, use the guess only if you have fallback verification (re-verify at signup, check mailbox activity post-send). 3. Track confidence scores in your CRM. Sort outreach lists by score. Send to 0.80+ first. 4. Feed back bounces to Coalstoke. We use every bounce to improve pattern accuracy.
Catch-alls are real. They're 15-20% of B2B domains. Pretending they don't exist costs money.