A per-client policy for catch-all email addresses before they hit a live sequence

Every agency eventually gets the same verification export back from a new client list. Most rows say valid, some say invalid, and a stubborn chunk says accept-all or catch-all. Someone has to decide what happens to that chunk, and if nobody writes the rule down, each campaign manager decides differently.

This guide is the rule we would write down.

What catch-all actually means

Hunter's help center defines an accept-all, also called catch-all, domain as one configured to accept all emails, even when they're sent to mailboxes that don't exist. Because the server says yes to everything, Hunter says no verification tool, including its own, can fully confirm deliverability on those domains.

ReplyLabs puts the practical consequence well. A catch-all address is not invalid. It is unconfirmed. The server accepts at the connection stage, and the real decision about whether the mailbox exists happens later. If it doesn't exist, that comes back as a bounce. SpamCipher adds that mail to nonexistent mailboxes on these domains may go to an admin bucket, get dropped silently, or bounce later after the server already accepted it.

So you are not choosing between "good" and "bad" addresses. You are choosing how much bounce risk each client's sending domain can absorb.

Step 1: split every list into three buckets

Before anything enters a campaign, sort verification results into verified, invalid, and catch-all. Invalid is suppressed. Verified goes to the main campaign. Catch-all goes to a holding segment and does not touch a live sequence until it passes the steps below.

Do this per client workspace. Two clients may share prospects at the same catch-all domain, and their decisions, suppressions, and bounce history should never mix.

Step 2: score each catch-all row on evidence

MailBeast's approach is to grade each address with everything you know besides the SMTP handshake. Their signals include whether the address is corroborated on the company site, LinkedIn, or multiple data sources; whether the local part looks like a real person's name; whether it matches the company's known email format; and whether it is a named person or a role box like info@ or sales@.

Hunter recommends something similar with its own confidence score, which it bases on the freshness and number of web sources that mention the address. Its rule of thumb is to keep accept-all emails at a minimum 85% confidence and lower the bar gradually based on bounce rate. If the sending domain is still warming up, Hunter suggests starting at 90% or higher and lowering it 5 points at a time. Hunter also says accept-all addresses with sources beat accept-all addresses without any.

For an agency, the important part is consistency. Pick the threshold per client, write it in the client's workspace notes, and let qualification apply it every time.

Step 3: test a small batch on its own

Don't commit the whole segment. MailBeast's guidance is to send a small slice, let bounces settle for a day or two, and only scale if the bounce rate stays sane. Their example: a test batch bouncing at 15% says the segment is mostly junk, and one at 2% says your scoring worked. SpamCipher says it more simply: the first fifty tell you about the next five hundred.

ReplyLabs recommends sending this segment from a secondary domain or subdomain at noticeably lower volume, so bounces land on infrastructure that isn't the domain the client most needs to protect. Inbound Labs makes the same point more bluntly: never let unconfirmed addresses ride along in the main campaign. If your client hasn't approved a secondary domain, the right answer is often to skip the risky segment entirely rather than test it on the main one.

Track the catch-all segment's bounce rate separately from the campaign total. A blended number hides exactly the thing you are testing.

Step 4: set a stop rule before you send

Write the stop number down before the first batch goes out, not after the bounces arrive. Inbound Labs frames the goal as keeping bounces under 2%. Pick a per-client threshold in that range and pause the segment automatically if a batch crosses it.

Hunter offers a useful sanity check for setting expectations: in general, the bounce rate of the accept-all emails in your list is around half the invalid rate of your full list. If 10% of the list came back invalid, expect roughly 5% of the catch-alls to bounce. A list with a high invalid rate is telling you the catch-all segment will hurt too.

Any address that bounces gets suppressed in that client workspace, and the suppression should survive later list refreshes and purges.

Step 5: route the leftovers to another channel

Some catch-all prospects are worth reaching even when the email can't be corroborated. Inbound Labs calls a suppressed catch-all a prompt, not a dead end, and suggests reaching that person through a verified direct dial, a LinkedIn message, or a different verified email. For agencies running email and LinkedIn from the same client workspace, that means a LinkedIn touch from the client's sender seat, under the same daily limits and with the same suppression rules.

Engagement can also settle the question. SpamCipher notes that a catch-all address that replies has proven a human reads it. Promote it, and stop treating it as risky.

The one-paragraph version for the client

Clients will ask why their list shrank after verification. Give them this: catch-all domains accept mail for any address, so no verifier can confirm those mailboxes. We send to the ones we can corroborate, test the rest in small batches with a stop rule, and reach the remainder another way. That protects your domain, which is the asset every future campaign depends on.

Where GTM fits

GTM qualifies prospects against each client's entry rules before anything is written or sent, keeps provenance on every field, and runs a compliance gate that blocks sends without a verdict and an unsubscribe URL. Suppression lives per client workspace and survives purge. A catch-all policy is one more entry rule, and it belongs in the system rather than in someone's head.

If you want list qualification and send rules enforced per client, join the waitlist.

Sources

• Hunter Help Center, "What does an 'Accept-all' email status mean?": https://help.hunter.io/en/articles/1935079-what-does-an-accept-all-email-status-mean
• ReplyLabs, "How to handle catch-all emails in cold outreach": https://www.replylabs.io/blog/catch-all-email-explained
• MailBeast, "How to handle catch-all (accept-all) emails on a cold list": https://mailbeast.ai/blog/catch-all-email-verification
• Inbound Labs, "How to handle catch-all emails in cold outreach": https://inboundlabs.app/blog/how-to-handle-catch-all-emails-in-cold-outreach
• SpamCipher, "Catch-all email, disposable inboxes, and role accounts": https://spamcipher.com/blog/catch-all-email