How Many Business Domains Are Catch-All? Nearly 5,000 Public Domains by Mail Provider
39.1% of business email domains in our sample accept mail for an address that does not exist. We drew 7,000 business domains at random from the public Tranco list of the 100,000 most popular websites and, on 14 November 2026, asked their mail servers whether a made-up address was real. 4,943 gave a definite yes or no, and 39.1% of them said yes (95% CI 37.7 to 40.5%). On those domains, no mailbox check can tell you whether a specific person's address will reach anyone.
The share depends heavily on who runs the mail. 52.3% of Google Workspace domains accepted the made-up address, against 19.6% of domains whose mail goes straight to Microsoft 365. Behind a security gateway such as Proofpoint or Cisco, it was 68.3%.
Why this matters for bounces
A verifier checks an address by asking the receiving server, during an SMTP conversation, whether it would accept mail for it, then hangs up before anything is sent. Most servers answer honestly: "yes" for a real mailbox, "mailbox not found" for a typo or a leaver. That second answer is what lets you remove addresses that would bounce.
A catch-all (or accept-all) domain says yes to everything. Ask about xk3q9z@company.com and it gives the same answer as for the founder's real address. So for every address on a catch-all domain:
- the check cannot confirm the mailbox, and
- the check cannot rule it out either.
The honest label is risky or catch-all, never valid. Whether that address bounces is only known once you send. More on how verifiers handle these in what is a catch-all domain.
How we measured
Each domain was tested with one address that cannot exist, using the same checking code that runs the free email checker.
- The list. Tranco is a public research ranking of websites, built from five traffic and DNS sources and designed to be reproducible. We used list ID Y897G (created 13 November 2026, covering 15 October to 13 November 2026) and kept the top 100,000 sites. Anyone can download the same list by that ID.
- The sample. We shuffled the 100,000 domains with a fixed random seed (20261114) and went down the shuffled list until we had 7,000 business domains with a working mail server. On the way we skipped 512 government, education and military domains (.gov, .edu, .mil, .ac and the like), 2,775 domains with no MX record, 242 consumer mailbox domains (gmail.com, outlook.com and similar, or MX at a consumer mail service) and 28 domains whose DNS lookup kept failing, out of 10,557 drawn. "Business" here means any remaining site with its own mail domain, so the sample includes companies of every size, media sites, non-profits and online services.
- The mail provider. We looked up each domain's MX records through public resolvers on 14 November 2026 and classified the first host with the same rules as our bulk email provider lookup. Where the MX pointed at a security gateway (Proofpoint, Mimecast, Barracuda and others), we read the domain's SPF record: an include of Microsoft's or Google's SPF, and not both, names the mailbox provider behind it.
- The test. For each domain our checker opened one SMTP conversation with its main mail server and asked about a random address such as
no-such-user-1a2b3c4d5e6f@domain. Accepted means catch-all. Rejected with "mailbox not found" means not catch-all. No email was sent, and the conversation ended before any message could be. - Untested domains. Of the 5,456 domains we asked, 513 (9.4%) gave no yes or no: the server could not be reached, kept greylisting after two re-asks, deferred, refused our check or said it does not take mail for the domain. They are counted as untested, never as catch-all, and every share below is of tested domains only.
- Stopped early, on purpose. The test was set to stop whenever servers started refusing our checking servers more often than usual, to protect their sending reputation. After 5,456 of the 7,000 domains it did, and we did not restart it, leaving 1,544 domains not asked. Which domains got asked was effectively random within each mail provider group, so the provider shares are unaffected. Mixed rows (all domains, website rank, domain ending, mailbox provider) are weighted back to the provider mix of the full 7,000-domain sample. Unweighted, the overall share is the same 39.1%.
- Pace. The test ran at a deliberately low rate, at most 20 conversations a minute overall and 2 a minute per sending IP for Microsoft and Google, from 05:00 to 10:09 UTC on 14 November 2026. Whenever a server refused us in a way that could point at our sending reputation, the test paused until we had checked our IPs against the public blocklists and against a server that had answered normally before.
- Uncertainty. Each share comes with a 95% confidence interval (Wilson; for weighted rows, on the effective sample size).
The study uses only public domains. No customer lists, customer domains or results from SimpleVerifier users were used.
Results by mail provider
| Mail front door (from MX) | Domains tested | Catch-all | 95% CI |
|---|---|---|---|
| All sampled business domains | 4,943 | 39.1% | 37.7 to 40.5% |
| Microsoft 365 (MX points straight at Microsoft) | 1,196 | 19.6% | 17.4 to 21.9% |
| Google Workspace (MX points straight at Google) | 1,712 | 52.3% | 49.9 to 54.6% |
| Security gateway in front of the mailbox | 530 | 68.3% | 64.2 to 72.1% |
| Other hosts and self-hosted servers | 1,505 | 29.4% | 27.1 to 31.7% |
Google Workspace domains were 2.7 times as likely to be catch-all as Microsoft 365 domains. Workspace rejects unknown addresses out of the box, the same way Gmail does: in our mailbox provider study, gmail.com refused a made-up address in both rounds. A Workspace domain becomes catch-all only when an admin routes unknown recipients to an inbox. We cover the setting in Google Workspace catch-all domains.
Microsoft 365 rejects unknown recipients at the door by default (Microsoft calls this Directory-Based Edge Blocking). The 19.6% that accepted our made-up address are most likely tenants where that is switched off, such as some hybrid setups that pass mail on to their own servers.
| Other hosts, in detail | Domains tested | Catch-all | 95% CI |
|---|---|---|---|
| Self-hosted and unrecognised mail servers | 1,187 | 31.3% | 28.7 to 33.9% |
| Smaller named hosts (Zoho, Amazon, GoDaddy, OVHcloud and others) | 220 | 15.0% | 10.9 to 20.3% |
| Email forwarding services | 98 | 38.8% | 29.7 to 48.7% |
Security gateways hide the mailbox
| Security gateway | Domains tested | Catch-all | 95% CI |
|---|---|---|---|
| Proofpoint | 318 | 72.3% | 67.2 to 77.0% |
| Mimecast | 61 | 32.8% | 22.3 to 45.3% |
| Other gateways (Cisco, Barracuda, Trend Micro and others) | 151 | 74.2% | 66.7 to 80.5% |
| Mailbox provider behind the gateway (from SPF) | Domains tested | Catch-all | 95% CI |
|---|---|---|---|
| Microsoft 365 behind a gateway | 171 | 64.9% | 57.5 to 71.7% |
| Google Workspace or not identifiable, behind a gateway | 359 | 69.9% | 65.0 to 74.4% |
| For comparison: Microsoft 365 with no gateway | 1,196 | 19.6% | 17.4 to 21.9% |
Mimecast is the exception, and the least certain row: only 61 of its 153 sampled domains gave an answer before the test stopped, so its interval is wide.
The same mailbox provider looks very different once a gateway sits in front of it. A gateway receives the mail first, filters it, and passes it on. Many are not connected to the company's list of real users, so they accept every address and leave the mailbox server to reject it later, after the check has ended. That is why Microsoft 365 behind a gateway was catch-all far more often than Microsoft 365 on its own.
Counted by mailbox provider, whatever the front door, 25.7% of Microsoft 365 domains (1,367 tested) and 52.7% of Google Workspace domains (1,761 tested) were catch-all. For working with gateway-protected lists, see verifying emails behind security gateways.
Bigger sites, more catch-all
| Website rank (Tranco) | Domains tested | Catch-all | 95% CI |
|---|---|---|---|
| Top 10,000 sites | 519 | 48.7% | 44.4 to 53.0% |
| Ranks 10,001 to 100,000 | 4,424 | 38.0% | 36.6 to 39.4% |
Domains of the 10,000 most popular sites were catch-all more often than the rest. Part of that is mix: the top sites run Google Workspace (38% against 30%) and security gateways (13% against 9%) more often. Part is behaviour: among Google Workspace domains alone, 61.6% of the top 10,000 accepted the made-up address, against 51.0% further down the list.
| Domain ending | Domains tested | Catch-all | 95% CI |
|---|---|---|---|
| .com | 2,445 | 41.9% | 40.0 to 43.9% |
| All other domain endings | 2,498 | 36.4% | 34.5 to 38.3% |
How this compares with other studies
Two other recent measurements publish a method we could trace:
| Source | Sample | Catch-all share | Google Workspace | Microsoft 365 |
|---|---|---|---|---|
| This study (Nov 2026) | 4,943 business domains from the Tranco top 100,000 | 39.1% of domains | 52.3% | 19.6% (no gateway) |
| BounceZero Inbox Infrastructure Report (Aug 2026) | 239,431 probed domains, Feb to Aug 2026 | 20.0% of domains | 33.2% | 17.6% |
| Reachium (Aug 2026) | 655,442 B2B addresses | 18.1% of addresses | not reported | not reported |
Figures as published on each page, read on 14 November 2026. Reachium counts addresses rather than domains, so its figure is not directly comparable.
Our overall share is about twice BounceZero's 20.0%, while our figure for Microsoft 365 with no gateway (19.6%) is close to their 17.6%. Most of the gap is in Google Workspace (52.3% here, 33.2% there) and in security gateways, which we report as their own group. The likeliest reason is the sample: ours is popular websites, which use Workspace and gateways more often than the average domain and lean towards larger organisations (see the rank table), while BounceZero's is a broad census of probed domains over six months. Checker differences could play a part too, since servers can answer different checkers differently. All three agree on the practical point: a large share of business email cannot be confirmed at the mailbox before you send.
What this means for your list
- Expect a large share of the business domains on a B2B list to be catch-all. That is the domains, not a fault in the verifier. Lists heavy in Google Workspace domains, or in larger companies behind security gateways, will run higher.
- Split by mail provider before you judge a verifier. A list mostly on Microsoft 365 with no gateway should come back largely valid or invalid. A list of Workspace and gateway domains will have a big risky share whatever tool you use.
- Send to confirmed addresses first. Treat catch-all addresses as their own segment: smaller batches, the best-sourced addresses only, and watch the bounces. Our guide to how many catch-all emails you can send has the numbers to plan with.
- Be wary of any tool that marks catch-all addresses "valid". On these domains the server accepted a made-up address too, so "valid" there describes the domain, not the mailbox.
To see which domains on your own list accept every address, run them through the bulk catch-all checker.
Limitations
- Popular websites, not all businesses. The sample is drawn from the 100,000 most visited sites. It over-represents larger and online-first organisations and under-represents small local businesses, which rarely make the Tranco top 100,000. It also includes media sites, non-profits and online services, not only companies.
- One checker, one day. All tests came from our own checking servers on 14 November 2026. A server can judge the checker as well as the question, so another verifier may get different answers at some domains, especially behind gateways.
- Untested domains are left out. 9.4% of the domains we asked gave no yes or no (240 could not be reached, 101 said they do not take mail for the domain, 80 refused our check, 46 gave no clear answer, 26 kept deferring or greylisting, and 20 were at a provider our own checker was pausing), most of them self-hosted servers. If those domains are more or less often catch-all than the rest, the shares would shift.
- Not every sampled domain was asked. The run stopped after 5,456 of 7,000 domains (see the method). The weighting corrects for the provider mix, not for anything else that might differ.
- Accepted at the check is not delivered. A catch-all domain may deliver to a shared inbox or bounce later. This study measures what the server said during the check, not what happened to real mail.
- Gateway attribution uses SPF. SPF names who sends a domain's mail, which usually but not always matches who hosts its mailboxes.
- Small groups. Some rows (Mimecast, forwarding services) rest on a few hundred domains or fewer; their confidence intervals are wide, and they are shown so you can judge.
The short version
- 39.1% of 4,943 business domains from the public Tranco top 100,000 accepted a made-up address.
- Google Workspace: 52.3% catch-all. Microsoft 365 with no gateway: 19.6%.
- Behind a security gateway: 68.3%. Microsoft 365 behind a gateway: 64.9%.
- Top 10,000 sites: 48.7%. Ranks 10,001 to 100,000: 38.0%.
- On a catch-all domain, no verifier can tell before you send whether an address will bounce.
How to cite this study
Link to https://simpleverifier.com/blog/catch-all-domains-by-provider-study-2026 and name the figure you use, for example: "SimpleVerifier (November 2026) found 39.1% of 4,943 business domains from the Tranco top 100,000 accepted mail for a made-up address."
Raw data: download the aggregate table as CSV. It is free to reuse with a link back to this page.
Check your own list
Paste one address into the checker above, or upload a CSV on the verify page: the first 100 email checks are free with a Google sign-in, no card. Every address comes back valid, risky or invalid with a reason, catch-all domains are marked as such, and you can download only the safe-to-send rows. Nothing is sent to the people on the list. More about how the checks work is on the SimpleVerifier homepage.
Common questions
What percentage of business email domains are catch-all?
In our November 2026 test of 4,943 business domains drawn at random from the public Tranco top 100,000 list, 39.1% accepted mail for an address we made up (95% CI 37.7 to 40.5%). Other 2026 studies with different samples report 18% to 20%, so the share depends heavily on which domains you look at. On catch-all domains no mailbox check can say whether a specific address exists.
Are Google Workspace domains catch-all?
Not by default, but many are set up that way. 52.3% of the Google Workspace domains in our sample (MX pointing straight at Google) accepted a made-up address. A Workspace domain becomes catch-all when an admin routes mail for unknown recipients to an inbox.
Are Microsoft 365 domains catch-all?
Most are not when mail goes straight to Microsoft: 19.6% of domains whose MX points at Microsoft 365 accepted a made-up address. When a security gateway such as Proofpoint or Cisco sits in front of Microsoft 365, the share was 64.9%, because many gateways accept every address before passing mail on.
Does a catch-all domain mean the email will not bounce?
No. It means the server accepted the address during the check. Some catch-all domains deliver everything to a shared inbox, others accept first and send a bounce later. Either way a verifier cannot tell a real mailbox from a made-up one there, so the honest label is risky or catch-all, not valid.
Can I reuse this data?
Yes. The CSV is free to reuse with a link back to this page. It holds the aggregate table only: group, domains in the sample, domains tested, untested and not asked, catch-all share, 95% confidence interval and the unweighted share. The sample itself is reproducible from the public Tranco list ID and the random seed given in the method.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.