Engineering Glossary · Mailbox Ops
Catch-All: A Dictionary Attack Aimed at Your Quota
Leaving a catch-all on makes every guessed address at your domain deliverable, and spam engines guess thousands of them a day without ever pausing for a bounce.
The short answer
A catch-all takes delivery of anything addressed to your domain whatever the local part, so mistyped and retired addresses come back to you — and so does an enormous volume of guessed-address spam.
The engineering consequence is that you have removed your own rejection step. Without a catch-all, mail to an unknown address is refused during the SMTP conversation and costs you nothing. With one, every invented address becomes a valid delivery: disk consumed, inodes allocated, filter cycles spent, and the mailbox behind it filling towards the quota where it stops accepting anything at all.
By the HostingFast team · Reviewed 12 August 2026
0
Jargon left undefined
100+
Entries, all cross-linked
Real
Working examples
Free
To read, always
With no catch-all in place, anything sent to an unknown address bounces. With one, it lands in a box you nominate. Spammers fire invented addresses at every domain they can find, so an open door gathers their entire harvest alongside the genuine strays you actually wanted back.
Give it boundaries and it behaves. Its moment is a migration window or a rebrand, while retired addresses are still pulling traffic — pointed at a collection box of its own, with the switch-off date decided in advance.
What accepting everything actually costs
Rejecting an unknown recipient happens at the RCPT TO stage, before any message data crosses the wire. That is the cheapest possible outcome for you and a clear signal to the sender. A catch-all replaces that rejection with an acceptance, so the whole message is transferred, written to disk as a file in the maildir, and scanned.
Both ceilings then apply. Disk usage grows, and so does the inode count, because every message is a separate file — a catch-all box collecting a few thousand junk messages a day accumulates file count faster than it accumulates gigabytes. When the mailbox hits its quota it stops accepting, and at that point the genuine stray you enabled the catch-all to rescue bounces too.
Measure the ratio before you decide
Point the catch-all at a dedicated mailbox rather than at anyone's inbox, and leave it for a fortnight. Then count two numbers: genuine misdirected messages, and everything else. The ratio is almost always worse than people expect, and it is the only argument that settles the question for your domain rather than in general.
The same fortnight tells you which misspellings actually occur. Usually there are two or three — a doubled letter, a missing hyphen, an old surname — and writing explicit forwarders for exactly those recovers the benefit while leaving the rejection step intact for everything else. That is the outcome you wanted; the catch-all was only ever the instrument for finding it.
The one case where it earns its place
A migration or a rebrand, while dozens of retired aliases still carry real traffic and nobody yet knows which. Here the catch-all is doing genuine discovery work, and the cost is bounded because the situation is temporary.
Set the end date on the day you enable it, not later. Put it in the calendar, point it at its own collection box, and review the log of distinct recipients before switching it off — that list is what becomes the permanent set of forwarders.
Where this lands on HostingFast
The default address setting, forwarders and per-mailbox quotas all live on the same screens in cPanel, so enabling a bounded catch-all and dismantling it later is a two-minute job either way. Human support is on duty every hour of every day if you want a second opinion on the ratio you measured.
Read next: Email Forwarder for the permanent replacement, Mailbox Quota for the ceiling this pushes you towards, Inode for the other ceiling, and Spam Filter for the layer that should be judging it.
Definitions written for people who deploy
To us, jargon nobody explained is a service defect. This glossary is the support team's collected translations — published with the limits, the trade-offs and the measurements still in them.
The rate you sign up at is the rate you renew at, so year two costs exactly what year one did — no ambush waiting in the invoice.
- 100+ entries, each with the mechanism spelled out
- Commands you can paste, numbers you can compare against
- Neighbouring terms wired together at the foot of every page
- Written by the engineers who answer the tickets
Why HostingFast
Standard on every plan
Both ceilings counted
Disk and inodes are separate limits, and mail hits the second one first. Entries here say which applies.
Measure, then decide
Where a trade-off depends on your traffic, the entry gives you the two numbers to count rather than a rule of thumb.
Mechanism, not vocabulary
What happens at RCPT TO, and what changes when you take that rejection away.
Temporary means dated
Anything described as a transitional measure comes with instructions for ending it on the day it starts.
Wired to its neighbours
Catch-All runs into Email Forwarder, Mailbox Quota and Inode — the three that describe the consequences.
This term, landed
Catch-all defined, its true cost quantified and its one legitimate use bounded — enough to make the call.
Quick Start
From order to online
- 1
Point it at its own mailbox, never a person's
A dedicated collection box keeps the measurement clean and stops the junk load landing anywhere that matters.
- 2
Count genuine strays against everything else
Two weeks of evidence gives you the ratio for your domain, which is the only version of the answer worth having.
- 3
Convert the real misspellings to forwarders and switch it off
Two or three explicit forwarders keep the benefit and restore the rejection step for every address nobody uses.
Built In
Loaded onto every plan
- Mailboxes on your own domain, included with the plan
- Spam and virus scanning on every mailbox by default
- cPanel, so default address, forwarders and quotas sit together
- Human support on duty every hour of every day
- Daily backups with self-service restores you run yourself from the panel
- Upgrades applied in place — changing plan is not a migration
- Money-back cover: 30 days on hosting plans, 7 on reseller
- Staging environments, so a change gets measured before it ships
- Free SSL on every plan, renewed automatically before it can lapse
- Softaculous on board for one-click application installs
Frequently Asked
What people ask us most often
Does a catch-all attract more spam over time?
It does not attract it — the guessing happens whether you accept or not — but it converts it. Without a catch-all those attempts are refused at RCPT TO and cost you nothing. With one they become deliveries: bytes on disk, files against your inode count and cycles through the scanner. The volume was always there; the catch-all is what turns it into consumption.
How do I find out which aliases people genuinely use?
Run the catch-all into a dedicated mailbox for a fortnight and list the distinct recipient addresses that received anything real. That list is short — usually two or three recurring misspellings — and it becomes your permanent set of explicit forwarders. The catch-all was the measuring instrument; the forwarders are the fix.
What breaks when the catch-all mailbox fills up?
Everything routed through it, including the genuine strays it was enabled to rescue. A full mailbox refuses new mail, and a box absorbing thousands of guessed addresses a day fills quickly — often hitting the inode ceiling before the size one, because every message is a separate file. That is a silent failure until somebody rings to say their email bounced.
Which company am I contracting with?
HostingFast is a trading name of Vitalcare at Home Ltd, registered in England and Wales — a real company with a public record and terms governed by English law. Running that check on any host before you point a domain at them is five minutes well spent.
Keep reading
MX Record
The mail servers that accept for your domain, and the priority order that decides which one is asked first.
Email Forwarder
The explicit routing that replaces a catch-all once you know which addresses people actually mistype.
How to Set Up a Catch-All Address
Setting one up with an end date on it, and reading the recipient list before you switch it off.
WordPress Hosting
WordPress on LiteSpeed with staging and daily backups — tuned rather than merely supported.
VPS Hosting
KVM virtual servers — root access, DDoS filtering and one flat monthly price.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Keep the rejection step.
Mailboxes and forwarders included with every plan, quotas and default address on one screen, and support at any hour.
View WordPress Hosting plans