Catch-All Domains in B2B Outreach: Send or Skip?

15-28% of Your Prospect List Is in Limbo

You pulled 5,000 contacts from Apollo. Ran them through verification. And now 900 of them came back labeled “accept-all” or “unknown.” Not invalid. Not valid. Just… gray.

Those are catch-all domains. The mail server accepts every address whether a real mailbox exists or not. Your verification tool can’t tell the difference between a real employee and a completely made-up address. Both get a 250 OK from the server.

Skip them all? You just lost a quarter of your pipeline. Send to all of them? You’re gambling your sender domain on addresses that might bounce at 8-15%.

Neither answer works. Here’s how to handle them instead.

Why So Many B2B Domains Run Catch-All

Dropcontact’s data puts the number at 15-28% of B2B domains configured as catch-all. Other studies measuring individual email addresses (not domains) report even higher figures. Allegrow estimates that up to 30% of contacts on typical B2B outbound lists sit on catch-all domains.

Why do companies set this up? Three common reasons.

Small and mid-market companies don’t want to miss emails from prospects or customers who typo an address. If someone sends to [email protected] instead of [email protected], the catch-all inbox grabs it.

Larger enterprises use catch-all as a defense against directory harvest attacks. If the server rejects unknown addresses, attackers can enumerate which employee accounts exist. Accepting everything reveals nothing.

And plenty of IT admins just flip it on during Google Workspace or Exchange setup without thinking about downstream effects. It’s the default “don’t miss anything” config.

The result? A huge slice of your B2B prospect list sits in a verification gray zone. And your outreach strategy needs a plan for it.

The SDR’s Dilemma

Here’s the tension every SDR faces with catch-all addresses.

The cost of skipping. If you exclude every catch-all address from your sequences, you’re cutting 15-28% of your addressable market. Those aren’t random consumers. They’re real employees at real companies. Decision-makers, budget holders, end users. Your competitor who figures out how to reach them has a structural advantage.

The cost of sending. Unverified catch-all addresses carry real bounce risk. Industry data suggests bounce rates of 8-15% or higher when you send to unfiltered catch-all lists. Blow past a 2% bounce rate and mailbox providers start throttling you. Your sender domain takes the hit, and clawing back reputation takes weeks of clean sending.

So what do you actually do?

The Test-Batch Strategy

Don’t guess. Test.

Pull your catch-all addresses into a separate segment. Pick 50-100 of them as a test batch. Send from your most established sending domain (the one with the strongest reputation). Monitor bounces in real time.

Here’s the decision tree based on what comes back.

Under 4% bounce rate on the test batch. Green light. Proceed with the rest of the catch-all segment using the same sending domain. Keep daily volume low (10-20 per domain per day) and continue monitoring.

4-8% bounce rate. Caution zone. Tighten your criteria. Only send to catch-all addresses that pass additional risk scoring checks (more on this below). Drop the rest.

Above 8% bounce rate. Stop. That domain’s catch-all configuration isn’t friendly to cold outreach. Suppress the remaining addresses from that domain entirely.

One SDR in a cold email community reported testing 200-300 catch-all addresses and hitting a 50% open rate with only a 4% bounce rate. Not every catch-all domain is a trap. Many contain perfectly reachable people. The test batch tells you which is which.

Segment and Isolate

Never mix catch-all addresses into your primary campaigns. Always separate them.

Create a dedicated campaign or sequence for catch-all contacts. Use a different sending domain or subdomain than your primary outreach. If catch-all bounces spike, your main domain stays clean.

Keep volume conservative. Where your verified campaigns might send 40-50 emails per domain per day, cap catch-all campaigns at 10-20 per domain per day. The lower volume gives you time to react before damage compounds.

Monitor this segment separately in your analytics. Your overall campaign bounce rate might look fine while your catch-all segment is quietly burning a domain. Track them independently so you see problems early.

Risk Scoring: Not All Catch-All Addresses Are Equal

A [email protected] at a 500-person company is a very different bet than [email protected]. Here’s how to score catch-all addresses before sending.

Email pattern match. Does the address follow the company’s known naming convention? If you can confirm the domain uses firstname.lastname@ format (from LinkedIn, company directories, or previously verified addresses at that domain), an address matching that pattern carries lower risk. Generic prefixes like info@, sales@, or random strings carry higher risk.

Company size. Bigger companies with established IT tend to have more predictable email patterns, even on catch-all domains. A catch-all address at a Fortune 1000 company is a safer bet than one at a five-person shop that might shut down next month.

Domain age. Older, established domains are less likely to be abandoned or misconfigured. A catch-all domain registered 10 years ago with active web presence is different from one registered last month.

Common name patterns. Addresses using real first and last names carry less risk than role-based addresses (team@, admin@) or random strings. If you can cross-reference the person’s name against LinkedIn or company directories, even better.

Historical performance. Have you sent to other addresses at this domain before? If three previous sends to catchall-corp.com all delivered successfully, the next address at that domain is a safer bet. If two out of three bounced, suppress the whole domain.

Stack these signals. An address that scores well on four out of five factors is worth sending to. An address that fails on three or more? Skip it.

The 2-4% Bounce Rate Rule for Catch-All Segments

Your verified email campaigns should stay under 1% bounce rate. Catch-all segments get a little more room, but not much.

Keep your catch-all segment bounce rate under 4%. That’s the ceiling. Anything above and you’re taking real reputation damage.

Why 4% and not the standard 2%? You’ve already isolated catch-all on a separate sending domain. The 2% ceiling still applies to your primary domain. Your catch-all domain can absorb a bit more because it’s purpose-built for this risk.

But don’t let that become an excuse. If your catch-all segment consistently bounces at 3-4%, tighten your risk scoring. The goal isn’t to ride the edge. It’s to reach valid contacts while keeping risk under control.

How the Major Platforms Handle Catch-All

Your cold outreach platform’s built-in verification matters here. They don’t all treat catch-all the same way.

Apollo. Their 7-step verification process can partially verify catch-all addresses by cross-referencing domain patterns and historical data from connected inboxes and CRMs. Apollo lets you filter by email status, so you can include or exclude catch-all results in your prospecting. Their waterfall enrichment (18 third-party data providers, out of beta since late 2025) improved coverage. During beta, Apollo reported 5% more email coverage and 45% lower bounce rates. Still, don’t treat their catch-all verification as definitive. Always run a secondary check.

Instantly. Catch-all verification is baked into their lead import flow. Instantly’s help docs claim you can recover 300-400 extra usable contacts from every 1,000 leads by verifying catch-all addresses instead of skipping them. They also offer bounce protection that auto-pauses sequences if bounce rates spike.

Lemlist. Integrates Bouncer for email verification, which includes deep catch-all verification on Google Workspace and Office 365 domains. Bouncer reports unknown rates as low as 0.3-3% on those providers. Lemlist’s own waterfall enrichment runs your data through multiple providers sequentially and claims 80% email find rates. Their help docs recommend sending to accept-all addresses in separate campaigns with close bounce monitoring.

Across all three platforms, the same advice applies: don’t rely solely on the platform’s built-in verification for catch-all addresses. Run them through a dedicated validation service as a safety net. Platform verification is a first pass. External verification is your insurance.

The Decision Framework

Here’s the complete workflow for handling catch-all addresses in your outreach.

Step 1: Separate. After verification, pull all catch-all/accept-all addresses into their own segment. Don’t mix them with verified contacts.

Step 2: Score. Apply risk scoring based on email pattern, company size, domain age, name patterns, and historical data. Drop anything that scores poorly on three or more factors.

Step 3: Test. Send a batch of 50-100 catch-all addresses from your strongest domain. Measure bounces over 48 hours.

Step 4: Decide. Under 4% bounce rate? Proceed with remaining addresses at low daily volume. Over 4%? Tighten scoring or suppress the segment.

Step 5: Monitor. Track catch-all campaign metrics separately from your main campaigns. Check bounce rates daily. Auto-suppress if bounces cross your threshold.

Step 6: Iterate. As you collect delivery data on catch-all domains, feed it back into your risk scoring. Domains that consistently deliver become “trusted catch-all.” Domains that bounce get blacklisted for future campaigns.

Don’t Skip Catch-All. Work Them Smarter.

The old advice was simple: avoid catch-all domains. Too risky.

That advice costs you 15-28% of your B2B market. In 2026, when inbox competition is fierce and every valid contact matters, that’s too much pipeline to leave on the table.

The better play: isolate, test, score, and monitor. Treat catch-all addresses as their own channel with its own rules. Send from dedicated domains. Keep volume low. Watch bounce rates like a hawk.

When we validated 10,000 Apollo contacts, catch-all addresses that passed risk scoring delivered at nearly the same rate as verified addresses. The difference wasn’t in the catch-all label. It was in which catch-all addresses we chose to send to.

Your verification tool already flags these addresses. The question isn’t whether to send to them. It’s which ones are worth the send. Use the framework, trust the data, and stop leaving a quarter of your prospect list in the “unknown” pile.

For a deeper technical breakdown of how catch-all domains work at the SMTP level and how multi-signal scoring identifies valid addresses, read the technical guide.