How to set up a catch-all email address
The switch on Google Workspace, Microsoft 365, Cloudflare and cPanel, the header to file by, and the five addresses a catch-all quietly hands to whoever reads it.
A Yowl organisation’s mailbox is a catch-all from the moment you register — there is no setting, because there is no other mode. Every address on the domain exists the instant somebody writes to it.
The catch-all is only half a feature. The other half is the sorting
Everything in the trade-off section below comes down to one sentence: a catch-all is free addresses paid for with an unsorted pile. Every guide tells you to weigh those against each other. Yowl’s answer is to stop paying.
Each message is read on arrival — the body and whatever is attached — classified, and filed under its
category. What the AI cannot place waits under a single Needs a look heading rather than spreading
across the page. So conference-2025@ still tells you who sold your address, and the invoice that
arrived at a name nobody provisioned is already filed as an invoice.
⛔ And nothing is dropped, ever. Not by a filter, not by the AI, not by a member tidying up. On a catch-all that matters more than anywhere else, because the pile is where things go missing — “the email never arrived” is answerable every time, because the message is there, and Yowl can tell you whether it was filed, muted, or deduplicated.
Invented addresses, and an AI that can use them
Here is the part that turns a catch-all from a convenience into something worth building on. Yowl hands the mailbox to an AI agent over MCP, and what the agent is told is: invent addresses freely.
So “sign this team up for the supplier portal” becomes a thing your agent can actually finish. It
makes up supplier-portal@yourdomain, fills the form, waits for the confirmation mail to land on
that address, reads the code out of it, and completes the sign-up. One address per supplier stops
being a discipline you have to maintain and becomes a side effect.
It is also the clean answer to the privileged-address problem below: a platform running catch-alls for other people has to refuse to hand out some local parts at all — the certificate-validation set, the RFC role addresses, and every address the service itself sends from. Those are reserved rather than allocated. Routing a multi-tenant catch-all is the builder’s version of that problem, including the one we got wrong.
And the header trap at the bottom of this page — that Delivered-To destroys the very thing you
needed — does not arise here. Yowl receives on a Worker, so the envelope recipient is captured at the
routing layer before any header rewriting can lose it.
Switching one on where you are now
A catch-all delivers mail sent to any address on your domain that does not exist to a mailbox you name,
instead of bouncing it. Addresses become free — one per supplier, one per project, none provisioned — and
the To: line tells you which was used, so when spam arrives at conference-2025@ you know who sold the
list. A misspelt name still lands, which for a small business is the difference between an order and
silence.
Per provider
Google Workspace. Menu → Apps → Google Workspace → Gmail → Routing, then find the Default Routing section and configure a rule delivering to your mailbox when the envelope recipient matches no user, group or alias.
⚠ There is no catch-all toggle, and looking for one wastes time. A setting literally named Catch-all address existed until Google made it read-only in January 2017 and folded it into unified Routing, so older guides send you to a screen that is gone. Point the rule at a group rather than a person, so more than one person can read it. Where routing settings conflict, the higher-priority one wins and the other is ignored.
Microsoft 365 / Exchange Online. There is no catch-all, native or otherwise. The workaround is to set the accepted domain to Internal Relay and add a mail flow rule redirecting mail for the domain to one mailbox unless the recipient is in a dynamic distribution group of all real users.
⛔ It is fragile in a specific way: dynamic groups populate on a background sync, so a newly created user’s mail goes to the catch-all until that sync catches up, and nothing tells you. If you need a catch-all, host that domain somewhere that has one.
Cloudflare Email Routing. Dashboard → Compute → Email Service → Email Routing → Routing Rules →
enable Catch-all rule → pick an Action: Send to an email (a verified destination), Send to a
Worker, or Drop. Specific rules handle their own addresses; the catch-all takes what is left. Rules
stay disabled until the destination address is verified, so a catch-all that appears to do nothing is
usually an unconfirmed destination. It also supports subaddressing (you+tag@, RFC 5233).
cPanel and most small hosts. Email → Default Address. Note the option you probably want is not Forward to email address but “Discard with error to sender (at SMTP time)” — it is the default, and it refuses at the connection instead of accepting mail you then have to deal with.
⛔ A catch-all hands five addresses to whoever reads it
This is the consequence nobody mentions. With a catch-all on, admin@, administrator@, webmaster@,
hostmaster@ and postmaster@ all resolve to your catch-all mailbox — and those five local parts are
exactly the set a certificate authority has historically used to prove you control the domain, under the
Baseline Requirements’ constructed email method (codified by CA/Browser Forum Ballot 190).
So everyone with access to the catch-all can potentially receive a domain-validation challenge for your domain. ⚠ Contested: email-based validation has been progressively deprecated, with a stated sunset in mid-2025, and sources disagree on whether the constructed-email method is still permitted at all — check the current Baseline Requirements. The access question stands either way, because plenty of other systems still prove ownership this way.
Practical version: a catch-all mailbox is a privileged mailbox. Treat its member list the way you treat
your DNS account’s. (postmaster@ is separately required to work at all, RFC 5321, and abuse@ is
expected of anything internet-facing — a catch-all satisfies both by accident.)
The trade-off
Dictionary spam. Bots send to info@, admin@, sales@ and a thousand first names on every domain they
find, and a catch-all receives all of it. Backscatter too: bounces from mail that forged a random address
on your domain as its sender. Four rules keep it sane:
- Never auto-reply from the catch-all. An auto-reply to a forged sender is spam you sent.
- Never accept and then bounce — decide at the connection, or keep it. A server that takes a message and rejects it later is a backscatter source.
- ⛔ Never forward a catch-all to an external mailbox. You then relay every dictionary attack that hits your domain to Gmail with your own domain and IP on it, and the reputation damage lands on you. Deliver locally, or drop.
- Read it somewhere that sorts. An unsorted catch-all is a spam folder with your invoices in it.
When not to
A domain with hundreds of people, where a bounce to a misspelt address is the signal you want the sender to get. Or any domain where nobody will read the catch-all: unread mail is worse than a bounce, because the sender believes it arrived.
Check it
Send to does-not-exist-2026@example.com from another account. It should arrive — and then read the
headers for the address it was sent to, which is what you file by.
⚠ Key on X-Original-To (or Exim’s Envelope-To), not Delivered-To. They are not interchangeable
and neither is in RFC 5322: X-Original-To records the original envelope recipient, while Delivered-To
records the final mailbox — which on a catch-all is the catch-all itself, destroying the one piece of
information you needed. If neither header survives, the envelope recipient has to be captured at the
routing layer; a Cloudflare Worker gets it directly.