Mail routing note · Intermediate · 5 minutes
How to set up a catch all address — Catch-All: Measure the Ratio Before You Keep It
You want mistyped addresses rescued, and you do not want a dictionary-attack firehose landing in the inbox you actually read.
The short answer
A catch-all is a routing rule, not a feature: cPanel's Default Address setting decides what happens to mail addressed to a name that does not exist on your domain, and the options are discard, bounce, or deliver into a mailbox you nominate.
Whether it earns its keep is a measurement, not an opinion. Route it into its own quota-capped mailbox, leave it a month, then count keepers against junk. On most domains the ratio settles the argument immediately; on a domain mid-rebrand it goes the other way.
By the HostingFast team · Reviewed 24 August 2026
Intermediate
Difficulty grade
5
Stages
Free
Support cost
Proven
Verified on
This is a decision with a small configuration change attached, so most of the work is deciding rather than clicking. The clicking takes about a minute.
It assumes you can open cPanel and create a mailbox. Everything reverses in the same screen, so nothing here is a commitment.
What the Default Address setting actually changes
Every domain has a default route for mail addressed to a name with no mailbox behind it. Out of the box that route discards or bounces. Set it to a mailbox and the server accepts the message instead — which means it also accepts every dictionary attack aimed at anything@yourdomain.
Accepting costs you three things: disk against the account quota, filtering work on every message, and attention. The first two are measurable, and the third is the one that actually bites, because a mailbox full of noise is a mailbox nobody reads carefully.
The measurement that decides it
Give the catch-all its own mailbox with its own quota, leave it running for a month, then count. Keepers are messages a human would have wanted; everything else is junk. On a typical small domain the ratio runs heavily against the catch-all.
The quota is not optional. Without one, a sustained dictionary attack fills the mailbox, and once the account is at its storage limit the mailboxes you care about start refusing mail too. Cap it and the worst case is that the catch-all stops accepting, which is exactly what you want it to do.
Cheaper alternatives that do most of the job
If you already know which addresses get mistyped — the two spellings of a surname, the old sales alias — named forwarders for those specific addresses deliver the same rescue and accept nothing else. That is usually the whole requirement.
Plus-addressing covers the other common motive: you@yourdomain and you+signups@yourdomain both reach the same mailbox with no configuration at all, and the tag tells you who leaked your address. Neither of these opens the domain to everything.
Time-boxing it, and what the platform contributes
The genuinely good use is a window: a rebrand or a migration where legacy addresses are still circulating and you cannot enumerate them. Switch it on with the shutdown date already in the diary, because a temporary catch-all left running is how the next spam problem starts.
Spam and virus screening applies to the catch-all mailbox exactly as it does to any other, so the volume that arrives is filtered rather than raw. That reduces the noise; it does not remove the reason to measure.
The platform this routing was configured on
Every screen here is a screen in your own account — cPanel, Default Address, Email Accounts — so the instructions match what you are looking at rather than approximating it.
Already hosted somewhere slower? We migrate the whole site free, usually within 24 hours, and it keeps serving visitors throughout.
- A decision made on counted data
- Quota capped before it is switched on
- Cheaper alternatives named
- Engineers on shift at any hour
Why HostingFast
Standard on every plan
A decision made on data
One month of collected mail gives you a keeper-to-junk ratio, which is the only honest input to this.
Its own mailbox, its own quota
Capped, so a dictionary attack cannot fill the account and start rejecting the mail you care about.
Cheaper alternatives named
Named forwarders and plus-addressing cover most of what people actually want a catch-all for.
Time-boxed by default
The strongest use is a migration window, with the shutdown date written down before it is switched on.
5 stages, mostly decisions
Five stages, four of them thinking and one of them a single Default Address setting.
Filtering applies as standard
Spam and virus screening runs on the catch-all mailbox exactly as on any other.
Quick Start
From order to online
- 1
Write down the question it answers
Rescuing known typos, or covering a rebrand you cannot enumerate? The first is a forwarder job. Only the second needs a catch-all, and only for a while.
- 2
Create a dedicated mailbox with a quota
Never point the default route at a mailbox somebody reads daily, and never leave it uncapped. The quota is what stops a dictionary attack becoming an account-wide outage.
- 3
Point the Default Address at it
cPanel, then Default Address, then the mailbox you just made. This is the only configuration step and it reverses in the same screen.
- 4
Add named forwarders for the typos you already know
The variants you can actually name deserve their own forwarders. Those keep working after the catch-all is switched off, which is the point.
- 5
Count a month, then decide and diary the exit
Keepers against junk, measured rather than remembered. Keep it, narrow it to forwarders, or switch it off — and if you keep it, put a review date in the calendar.
Built In
Loaded onto every plan
- Spam and virus screening on every mailbox as standard
- Mailboxes on your own domain, included with the plan
- IMAP, POP, SMTP and browser webmail on every mailbox
- Daily backups with restores you trigger yourself from the panel
- Migration handled by our engineers at no charge
- Free SSL on every plan, renewed automatically before it can expire
- NVMe SSD storage on every tier, not just the expensive ones
- Tier changes applied in place — no migration when you scale up
- SSH, Git and Composer on the developer-focused plans
- PHP version set per site from the panel, not per server
Frequently Asked
What people ask us most often
Does a catch-all add load to my hosting account?
Some, and it is measurable. Every accepted message is scanned and written to disk against your storage quota, so a sustained dictionary attack turns into real disk and real filtering work. A quota on the catch-all mailbox is what keeps that bounded.
Is bouncing unknown addresses better than discarding them?
Rejecting at the point of delivery is fine — the sending server is told immediately and no message is generated by you. Accepting first and bouncing afterwards is the one to avoid, because the bounce goes to a forged sender and turns your domain into backscatter.
Does the renewal price differ from the sign-up price?
No. The rate you order at is the rate you renew at, every single year. We run no introductory teaser pricing, so there is no year-two jump lying in wait — your hosting line item stays a fixed number your accounts can rely on.
Which company stands behind HostingFast?
HostingFast is a trading name of Vitalcare at Home Ltd, registered in England and Wales — a real company with a public record and terms governed by English law. Running that check on any host before handing over a domain is time well spent.
Keep reading
How to Edit DNS Records
A, CNAME, MX and TXT records changed with the TTL understood before you press save.
How to Speed Up WordPress
The handful of changes that actually move load times, measured rather than assumed.
Catch-All Email (Glossary)
What accepting mail for every possible name really means, defined in one screen.
Domain Names
Register or move a name — the first year is included with an annual plan.
Magento Hosting
Plans with the memory and PHP headroom Magento genuinely needs.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Route it deliberately.
Free SSL, free migration, renewal at the rate you signed up at, and engineers on shift around the clock.
View Domain Names plans