How to Set Up a Catch-All Email Address on Your Custom Domain (Safely)

Picture a freelancer who has used info@theirdomain.com for years. It's on business cards, directory listings and in meetings, and every variation they didn't explicitly set up, such as contact@ or hello@, bounces into the void without anyone noticing.

A catch-all would have caught those messages. If you're setting up email for the first time, this is one of the first things to consider.

But here's the thing: catch-alls come with a tradeoff that nobody talks about until your inbox is drowning in spam to xqz7rand0m@yourdomain.com. This guide covers how to set up a catch-all properly, when you should skip it entirely and use aliases instead, and how to combine catch-all with spam filtering so you actually get the benefits without the pain.

What We're Building

By the end of this, you'll have a catch-all email address on your custom domain — one that captures any email sent to *@yourdomain.com without bouncing. You'll also know how to filter the garbage so it doesn't bury the legitimate messages.

If you're on JustEmails, catch-alls are included in the plan. Other providers vary. This guide covers both.

Prerequisites

• A custom domain you control (with DNS access)
• An email hosting provider that supports catch-all (most do)
• Access to your email admin panel
• Basic familiarity with spam filtering settings (optional but helpful)

Step 1: Understand What Catch-All Actually Does

A catch-all address receives all email sent to your domain that doesn't match an existing mailbox or alias. That's it. No magic, no complexity.

If you have:

• mike@yourdomain.com (real mailbox)
• support@yourdomain.com (alias → mike@)
• catch-all → mike@yourdomain.com

Then:

• Email to mike@ → mike's inbox
• Email to support@ → mike's inbox (via alias)
• Email to anything-else@ → mike's inbox (via catch-all)

The catch-all acts as a fallback. Existing mailboxes and aliases always take priority.

Why this matters: you don't need to "predict" every address someone might use. Typos, variations, old addresses from previous employees, random strings spammers try — they all land somewhere instead of bouncing.

Step 2: Enable Catch-All in Your Email Provider

The exact steps depend on your provider. Here's how it works in the common ones.

JustEmails

1. Log into your dashboard
2. Open the domain you want to cover
3. Turn on catch-all for that domain
4. Pick which mailbox receives catch-all emails
5. Save

Google Workspace

1. Admin console → Apps → Google Workspace → Gmail
2. Default routing → Add rule
3. Match envelope recipients set to Unrecognized / Catch-all, and change the envelope recipient to a specific user
4. Save

Google buries this in the routing settings rather than giving you a simple toggle. Classic Google admin experience — three submenus and a save button that's somehow both obvious and easy to miss.

cPanel / Webmail Providers

Most shared hosting uses cPanel. Look for:

• Email section → Default Address (or "Catch-All")
• Enter the target mailbox
• Save

Some hosts disable catch-all by default due to spam concerns. You might need to contact support.

Microsoft 365

Microsoft doesn't have true catch-all. You can create a transport rule that redirects undeliverable mail to a specific mailbox, but it's clunky and doesn't work the same way. Honestly? If you need proper catch-all behavior, Microsoft is the wrong tool. That's a strong take given how many businesses default to M365, but it's a fair one for this feature.

Step 3: The Spam Problem (And Why Most Guides Ignore It)

Here's what nobody tells you upfront: catch-all is a spam magnet.

Spammers don't carefully research your company's email addresses. They blast random strings — admin@, webmaster@, info@, sales@, test@, random1234@. With no catch-all, these bounce. With catch-all enabled, they land in your inbox.

A domain that's been around for a few years can attract a lot of mail to addresses that don't exist: invoice72849@, notification@, and strings that are clearly dictionary attacks.

It's frustrating. You enable a feature to help you, and suddenly you're drowning.

The fix isn't disabling catch-all. The fix is spam filtering plus keeping catch-all traffic out of your main inbox.

Step 4: Configure Spam Filtering for Catch-All

Your email provider almost certainly has spam filtering. But catch-all traffic tends to be dirtier than normal email, so it deserves more scrutiny.

JustEmails uses Rspamd + ClamAV

Rspamd is the open-source spam filter that powers a lot of modern email hosting. It scores incoming messages based on dozens of signals — SPF/DKIM/DMARC pass/fail, content patterns, sender reputation, header analysis.

On JustEmails, Rspamd scoring runs server-side and isn't user-adjustable, so there's no spam threshold to lower. The spam settings give you two controls instead: a quarantine you can review, and sender allow and block rules. For catch-all specifically:

1. Point the catch-all at a dedicated mailbox rather than your main one (more on that in Step 5)
2. Block the sender domains that keep showing up in it
3. Review the quarantine for real messages, and allow those senders so they aren't held again

For other providers

The principle is the same: catch-all traffic deserves more scrutiny than direct-address traffic. Look for:

• Custom spam thresholds per mailbox
• Filter rules based on recipient matching
• The ability to route probable spam to a folder you still check

If your provider doesn't let you do any of this, you're stuck with whatever default filtering they provide. It'll catch most garbage, but your inbox will still be noisier than necessary.

Step 5: When to Use Aliases Instead

Catch-all isn't always the right answer. Sometimes explicit aliases are better.

Use aliases when:

• You know exactly which addresses you need (support@, sales@, billing@, your name)
• You want strict control over what enters your inbox
• Your domain is old, exposed, or on spam lists
• You're running email for a client and don't want to explain why they're getting random spam

Use catch-all when:

• You're using a new domain with low exposure
• You give out your email address in contexts where typos are common (printed materials, phone conversations)
• You've bought a domain from someone else and don't know what addresses they used
• You're paranoid about missing something important

Use both when:

• You want to capture typos and random addresses while still having clean primary aliases

At JustEmails, creating aliases is free and unlimited. You can set up info@, support@, contact@, hello@, and your own name — then add a catch-all as the safety net for everything else. This gives you the best of both approaches.

One technique I like: create a dedicated mailbox just for catch-all traffic. Something like catchall-bucket@yourdomain.com. Set that as your catch-all destination. Then check it once a week, or twice if you're cautious. This keeps your primary inbox clean while still capturing stray messages.

Step 6: Test That It's Working

Enable catch-all, then send yourself a test email to a completely random address — asdfkjhsdfsdf982374@yourdomain.com. If it arrives in your catch-all destination, you're good.

If it bounces, check:

• Is the catch-all actually enabled? (Some providers require a save/apply step)
• Is there a typo in your destination mailbox?

Also verify that your real mailboxes still work. Send to info@, support@, whatever you've got. These should still route to their intended destinations, not the catch-all.

Common Errors and Fixes

The destination mailbox doesn't exist

The mailbox you're routing to doesn't exist or was deleted. Create it first, then set up catch-all.

Your host has catch-all switched off

Some shared hosting providers disable catch-all at the server level due to abuse. Contact support. On JustEmails or any provider where you have full control, this won't happen.

Catch-all mail is landing in spam

This is usually the system working as intended — mail to random addresses is more likely to be spam. Which is annoying when it's a real message. On JustEmails, rescue it from the quarantine and add an allow rule for that sender; on providers with adjustable filtering, loosen the threshold for the catch-all mailbox if too many legitimate messages get caught.

Messages still bounce after enabling catch-all

Some providers take a few minutes to apply a routing change. Wait 15-30 minutes and test again. Also check that you don't have a rule rejecting unmatched recipients that overrides the catch-all setting.

What About DMARC Reports?

If you've set up DMARC properly (and you should — here's our guide to moving from p=none to p=reject safely), you're receiving aggregate reports about email authentication. Those reports go to whatever address your DMARC record's rua tag names, such as dmarc-reports@yourdomain.com.

If that address is on your own domain, some people let the catch-all receive the reports instead of creating a dedicated mailbox. That works, but I'd recommend creating the explicit alias. DMARC reports can pile up if your domain sends volume, and mixing them with actual catch-all traffic makes both harder to manage.

Privacy Consideration

With catch-all enabled, anyone can email any address at your domain and reach you. For some people (freelancers, consultants, small business owners), that's exactly the point.

For others, it's a privacy concern. If someone wants to see whether a domain is actively receiving mail, they can email unique-probe-string-1234@yourdomain.com and see if it bounces. No bounce = someone's receiving it.

This is minor — most people won't do this — but worth mentioning.

Next Steps

Now that catch-all is working, consider:

• Setting up separate mailboxes for catch-all vs. primary traffic — keeps things organized
• Reviewing your alias list — if you're using catch-all to cover gaps, you might want to formalize the important ones as real aliases
• Checking your quarantine and catch-all mailbox after a week — see how much garbage catch-all is pulling in and block the repeat senders

For multi-domain setups (agencies managing client domains, SaaS founders with product domains, anyone with more than one domain), catch-all on every domain means stray messages to any of them still land somewhere. Combined with the unified inbox in JustEmails, you can manage catch-all traffic from all your domains in one place — without switching accounts.

Frequently Asked Questions

Will a catch-all address hurt my domain reputation?

Not directly — your domain reputation is based on what you send, not what you receive. But if spammers harvest your catch-all and start sending phishing emails that spoof your domain, that's a separate problem. The bigger practical issue is inbox noise: you'll get flooded with spam to random addresses, which wastes time and storage. Combine catch-all with strong spam filtering (like Rspamd) to mitigate this.

Can I use catch-all and individual mailboxes at the same time?

Yes. Individual mailboxes take priority. If you have sales@yourdomain.com as a real mailbox and a catch-all enabled, emails to sales@ go to the sales mailbox. Emails to random-string@yourdomain.com go to the catch-all. This is the standard behavior on providers that support catch-all.

What's the difference between a catch-all and an alias?

An alias is a specific secondary address that forwards to a primary mailbox (e.g., info@ forwards to you@). A catch-all captures everything not already matched by a real mailbox or alias — including typos, old addresses, and spam. Aliases are targeted; catch-all is a net. Use aliases when you know the addresses you need. Use catch-all when you don't.

How much spam will I actually get with a catch-all enabled?

It depends on your domain's age and exposure. A brand-new domain usually sees little at first. An older domain that's been on marketing lists or had addresses scraped from websites can see far more. Spam filters handle most of it, but you'll still spend more time on email hygiene than if you used explicit aliases only.

---

Try JustEmails

Unlimited custom domain email hosting for $49/year flat — unlimited domains, unlimited mailboxes, 10 GB storage, full IMAP/SMTP. Built for agencies, freelancers, and anyone managing email across more than one domain.

Start your 7-day free trial → · How it compares