Every few months someone discovers that their catch-all domain is drowning in spam and reaches for the nuclear option: a server rule that deletes anything sent to an address that does not exist. It feels tidy. The inbox gets quiet. Then a real customer emails sales@ yourdomain instead of sales@yourdomain, hits the catch-all, gets silently binned by the same rule, and nobody ever finds out. The lead is gone, the sender assumes you ignored them, and the filter that “fixed” the spam problem quietly broke the reason you set up a catch-all in the first place. The fix is not a delete rule. It is a quarantine folder with a retention window and an alert that fires when volume jumps.
Why the delete rule looks right and fails quietly
A catch-all email address accepts every message sent to a domain, whether or not a mailbox exists for that recipient. That is the whole point of the feature, and it is also the whole problem. A standard mail server replies with 550 no such user when no mailbox matches, which lets the sending side know immediately that the address is wrong. A catch-all suppresses that bounce. The sender believes delivery succeeded, and your server now owns the message, spam and typos alike.
Here is the mistake in concrete terms. Your catch-all has been live for a year. Spam volume creeps up because scrapers and dictionary attackers have learned that every guess lands somewhere. Someone on the team adds a sieve rule or a Postfix header check that discards mail to unknown recipients when the spam score crosses a threshold. The spam stops. So does the mail from a procurement manager who typed your domain with a doubled letter. So does the message from a conference organizer who guessed firstname@ instead of info@. You will never see a bounce, never see a complaint, and never see the pattern, because the evidence was deleted at the moment of arrival.
Deletion is irreversible by design. Quarantine is reversible by policy. That single distinction is worth more than any Bayesian tuning you will do this quarter.
Route suspicious catch-all mail to quarantine instead
The alternative is boring and effective: keep accepting everything the catch-all receives, but sort it. Mail that passes SPF, DKIM and DMARC checks and looks like normal correspondence goes to the inbox. Mail that fails authentication, carries a high spam score, or arrives for an address that has never received legitimate mail before goes to a quarantine folder with a retention window. Thirty days is a reasonable default. Seven is too short for a small team that checks folders weekly. Ninety is fine if you have disk and a search habit.
Quarantine works because the catch-all also receives typo’d mail from real customers, and those messages are indistinguishable from spam at the moment of delivery. A message to saels@yourdomain.com from a Gmail account with no links and clean headers could be a new prospect or a low-effort spam run. You cannot tell at SMTP time. You can tell three days later when the sender follows up, or when you scan the folder and spot a real company name in the subject line. Deletion removes that option. Quarantine preserves it.
Setting up the quarantine path on common stacks
On Postfix with Dovecot, the cleanest approach is a dedicated transport or a header check that files low-confidence mail into a CatchAll/Quarantine IMAP folder rather than issuing a reject or discard. A fallback rule at the mail server level should route unmatched recipients into a single catch-all mailbox, and the spam filter should add a header like X-CatchAll-Score instead of acting on it directly. Dovecot sieve then files anything above your threshold into the quarantine folder and leaves it there. source offers additional context worth reviewing. On Exim, the equivalent is an ACL that accepts unknown recipients into the catch-all and a router that tags rather than drops. In cPanel, the default address handles the catch-all, and you can pair it with per-account filtering rules that move high-score mail to a folder. In Cloudflare, Email Routing can forward a wildcard address to a mailbox you control, but note the constraint: a catch-all email is configured on the mail server, not in DNS. Cloudflare’s routing forwards; the quarantine logic lives wherever the message finally lands.
Whichever stack you run, keep the retention window explicit and visible. A quarantine folder that nobody documents becomes a black hole with extra steps.
Alert on volume, not on individual messages
Individual spam messages are noise. A change in the shape of the traffic is signal. A catch-all carries the risk of accepting spam to invented addresses, and attackers test domains in bursts: a few hundred probes in an hour, then silence, then another burst from a different subnet. If your catch-all normally receives 40 messages a day and suddenly takes 400, something is scanning you, and the same burst may be hitting typo variants of real addresses. Alert on that delta.
A simple monitoring job that counts messages landing in the catch-all per hour and pages when the count triples will catch dictionary attacks, scraped-list blasts, and misconfigured senders before they bury the legitimate mail you actually care about. Pair it with a weekly glance at the quarantine folder. Two minutes of scanning subjects catches the typo’d customer mail that automated scoring will never flag.
- Set the quarantine retention window in writing and put it in the mailbox documentation, not in someone’s head.
- Never discard at SMTP time based on spam score alone when the recipient is a catch-all; tag and file instead.
- Alert when catch-all volume triples against a rolling seven-day baseline, not on single high-score messages.
- Review quarantine subjects weekly for real names, real companies, and reply threads that look like ongoing conversations.
- Keep SPF, DKIM and DMARC tight on outbound mail; they govern outbound mail only and will not reduce inbound spam to the catch-all.
The distinction between a catch-all and its cousins matters here too. Catch-all differs from alias, forwarding and disposable addresses: an alias points a known name at a real mailbox, forwarding relays to another host, and a disposable address is generated per sign-up. A catch-all is the wildcard that catches everything else, which is exactly why it needs quarantine rather than a delete rule. Catch-all domains are used for unlimited unpredictable addresses in automation and sign-ups, and that flexibility is worth keeping, as long as the unknown-recipient acceptance is handled with a retention policy instead of a guillotine.
If you are still mapping out the basics, AllMail.one publishes a guide to catch-all email that covers the DNS and server side, including why MX records route inbound mail to a mail server while authentication records do not. A working catch-all setup requires DNS pointing at the right host and a server accepting unknown recipients, and once that is in place, the filtering policy is the part you own.
Start by auditing what your server currently does with unknown recipients. If a rule discards them, replace it this week with a quarantine folder and a 30-day retention window. Add a volume alert against your normal baseline. Then check the folder once a week for a month and count how many real messages you would have lost under the old rule. That number is your argument for never going back to auto-delete.
