Email List Health Report 2026: Catch-All Rates Across 54,463 Domains

Catch-all rate by mail platform

A catch-all domain answers “yes” to any recipient, including a random one we generate before checking the real address. That yes says nothing about the real mailbox, so the honest result for every address on the domain is risky. We grouped each domain by the mail exchanger (MX) it published on 12 October 2026.

Our sample leans heavily on Brazilian domains, so we checked whether the platform gap is a regional artefact. Google Workspace held steady; Microsoft 365 did not.

Security gateways hide the most mailboxes

Many organisations put a filtering service in front of their mailboxes. Some of these accept every recipient at the edge and decide later what to deliver, which turns the whole domain into a catch-all from a verifier’s point of view. Behaviour varied widely between vendors, and even between two Proofpoint products.

Other mail hosts

Hosting-company mailboxes were usually checkable. Forwarding and relay services were the exception: every MailChannels domain in the sample accepted any recipient, and so did close to half of the domains on Cloudflare Email Routing.

Catch-all rate by top-level domain

TLDs with at least 50 domains in the sample. Newer startup-style TLDs (.io, .ai, .co) and .edu ran well above the overall 27.5%. 204 smaller TLDs were suppressed.

Free mailbox providers: who answers a mailbox check

Address-level outcomes for free providers with at least 50 addresses in the sample. Gmail and Yandex give a real answer for each mailbox; Yahoo and Mail.ru say yes to everything, so their addresses can only come back risky.

Microsoft’s consumer domains (outlook.com, hotmail.com, live.com, msn.com) and Apple’s (icloud.com, me.com, mac.com) are not in the table: SimpleVerifier does not probe them, because their servers do not give a dependable per-mailbox answer. When we did probe live.com and msn.com on 12 October 2026, both refused the connection with Microsoft’s S3140 block-list reply.

32 more consumer providers, probed on 12 October 2026

One SMTP conversation per provider, offering a made-up recipient and disconnecting without sending. Each domain links to its page with the server’s reply quoted as received.

What this means for cleaning a list

• Expect a real share of a B2B list to come back risky however good the verifier is. On this sample that share is driven by the recipient’s mail platform, not by list quality.
• A verifier that returns “valid” for addresses on catch-all domains is reporting the domain’s configuration, not the mailbox. Ask how a tool treats them.
• Segment catch-all results and send to them in small batches, suppressing hard bounces. Our guide to sending to catch-all emails covers the approach.

Methodology

Sample

165,460 distinct addresses on 54,463 distinct domains that reached a live SMTP mailbox check on SimpleVerifier’s checking server, with the latest check for each address falling from 10 September to 12 October 2026. The addresses come from list uploads, API calls, email-finder lookups, lead-list enrichment and our own lead research run through the service. Checks that ended without a verdict (timeouts, temporary refusals, blocked connections) are not stored, so they are not counted. 42,913 of the domains contributed a single address.

What was measured

For each address the server connected to the domain’s mail exchanger, first offered a random recipient that cannot exist, then the real address, and disconnected without sending. If the random recipient was accepted the result is “accepts all addresses” (catch-all, reported as risky). Otherwise a 250 reply is “mailbox exists” (valid) and a 550, 551, 553 or 554 reply is “mailbox not found” (invalid). A domain counts as catch-all when most of its checked addresses got the catch-all result; only 6 domains gave mixed answers.

Valid, risky and invalid

Valid means the receiving server confirmed the mailbox. Invalid means it said the mailbox does not exist, or the address failed earlier checks (syntax, no mail server, disposable domain). Risky is everything that could not be confirmed either way: catch-all domains, role addresses, providers that hide mailbox status and temporary refusals. Nothing unconfirmed is ever reported as valid.

Grouping

Mail platforms and hosts were assigned from each domain’s highest-priority MX record, looked up on 12 October 2026. Google Workspace means an MX under google.com or googlemail.com; Microsoft 365 means mail.protection.outlook.com; security gateways were matched on the vendor’s MX suffix. Domains with no MX record on that date and the handful of free-webmail domains are left out of the platform table.

Privacy and suppression

Only aggregates are published, by mail platform, mail host, top-level domain or public mailbox provider. No address, customer, customer domain or file name appears on this page or in the CSV. Any group with fewer than 50 domains (or, for mailbox providers, 50 addresses) is suppressed. Our own test uploads (313 rows over the period) cannot be separated from the check log; at under 0.2% of the sample they cannot move any published figure. The counts were computed on the checking server and only the totals left it.

Limitations

This is not a random sample of the internet’s domains. It reflects what passed through one verification service in five weeks: 56.9% of the domains are Brazilian (.br), and the rest lean towards small and mid-sized businesses. Email-finder lookups test guessed name patterns, which inflates the address-level “not found” count on company domains, so this report does not publish an overall valid/invalid rate for business addresses; domain-level catch-all rates are unaffected because they come from the random-recipient test. Role addresses, disposable domains and Microsoft and Apple consumer domains are classified before any mailbox check, so they are not in this sample. Uploaded customer lists over the period came from too few accounts to report separately without describing an individual customer, so they are not broken out. A domain’s catch-all setting can change at any time; a single check is a snapshot.

Questions

What share of business email domains are catch-all?

In SimpleVerifier's sample (checks from 10 September to 12 October 2026), 27.5% of 54,463 domains accepted mail for a made-up address. The rate depended heavily on the mail platform: 46.7% for Google Workspace, 23.2% for Microsoft 365 and 60.3% behind a security gateway.

Are Google Workspace domains more often catch-all than Microsoft 365?

In this sample, yes. 46.7% of 13,925 Google Workspace domains accepted a made-up recipient, about twice the 23.2% of 16,132 Microsoft 365 domains. The Google rate held at roughly 45 to 48% both for Brazilian (.br) domains and for the rest.

Can Gmail addresses be verified without sending an email?

Yes. Gmail's servers reject unknown recipients during the SMTP conversation. Of 44,298 gmail.com addresses SimpleVerifier checked, 94.0% were confirmed to exist, 6.0% were rejected, and none came back catch-all.

Why do security gateways make email verification harder?

Gateways such as Barracuda, Proofpoint and Cisco Secure Email often accept every recipient at the edge and decide later whether to deliver. In this sample 60.3% of 3,019 gateway-fronted domains accepted a made-up address, so verification can only return risky for them.

Can I cite these numbers?

Yes. The aggregate data is published as CSV under CC BY 4.0. Cite it as: SimpleVerifier, "Email List Health Report 2026: Catch-All Rates Across 54,463 Domains", 2026-10-12, https://simpleverifier.com/research/email-list-health-2026.