A catch-all (also called a "default address") catches any mail sent to your domain that doesn't match a real mailbox. If someone emails infp@yourdomain.com instead of info@yourdomain.com, a catch-all delivers it instead of bouncing it. That's the whole feature: a safety net for typos and old addresses, not a mailbox you should read directly.
Set one up if you're worried about losing mail to misspellings or a retired address. Skip it, or turn it off, if your domain gets any real-world spam scanning, because a catch-all also collects every guessed address a spammer throws at your domain.
When a catch-all earns its keep
The good cases are narrow and specific:
- Typo protection. Someone types
john@instead ofjon@. Without a catch-all, that bounces and the sender assumes you never got it. With one, it lands somewhere you can find it. - Migrating off an old address scheme. You used to hand out
firstname.lastname@addresses and switched tofirst@. A catch-all keeps mail flowing to the old pattern while people update their address books. - Short-term coverage during a transition. New hire, new department, new domain, anything where you know mail will arrive at addresses that don't exist yet.
In all three cases, the catch-all is a temporary net, not a permanent inbox. Route it to a mailbox someone actually checks, and treat anything that lands there as a signal to either create the missing address or tell the sender the correct one.
When it backfires
A catch-all has one structural problem: it accepts mail for addresses that don't exist. Spammers exploit exactly that. Automated senders test thousands of guessed addresses against a domain (sales@, admin@, accounts1@, random strings), and every domain without a catch-all just bounces those attempts at the server level, before anything reaches a mailbox. A domain with a catch-all accepts all of it, so your spam volume goes up, and it goes up specifically with junk addressed to accounts nobody uses, which is exactly the traffic your spam filters can't cross-reference against anything.
It also affects deliverability indirectly. If a large share of what your catch-all collects is spam, and you or a filter start auto-deleting from it, you risk quietly deleting the one legitimate typo-catch a catch-all was supposed to save. There's no way to tell a spam probe apart from a real typo just by looking at the destination address; you're stuck reading through the noise.
Route it somewhere that isn't your main inbox
If you decide a catch-all is worth it, don't point it at the address you use every day. Two better options:
- Point it at a dedicated mailbox created for that purpose, checked occasionally, never trusted for anything time-sensitive.
- Forward it, rather than deliver it to a mailbox at all, if all you want is visibility without storage.
Either way, put real spam filtering in front of whatever the catch-all feeds. Since a catch-all mailbox is going to see a higher spam ratio than any of your real addresses, that's where you actually need the filter working, using cPanel's Spam Filters tool tuned with a reasonable score threshold and a whitelist for anything you expect to receive there.
A catch-all doesn't fix authentication problems
If mail to your domain is bouncing or landing in spam and you're considering a catch-all as the fix, check whether the real issue is authentication first. A catch-all only affects which local part of the address gets accepted; it does nothing for how the receiving server judges the message once it's in. If you're troubleshooting bounces from your own outgoing mail rather than incoming typos, that's a DKIM and SPF question, not a catch-all question.
Also worth knowing: mailboxes have storage limits, so a busy catch-all can fill up faster than you'd expect since it's absorbing every guessed address a bot tries. If it does, use Email Disk Usage to see what's actually accumulating there before you assume it's legitimate mail worth archiving.
Setting it up
In cPanel, go to Email → Default Address (catch-all), set the destination to a mailbox or forwarding address you've already created, and check back periodically to gauge how much volume it's actually pulling in before deciding to keep it.
When to contact support
If you turn on a catch-all and your spam volume spikes in a way your filters can't keep up with, or you're not sure whether a bounce problem is a catch-all issue versus an authentication issue, open a ticket from the portal. Support can look at your domain's actual mail flow and tell you which one you're dealing with, rather than guessing from symptoms.