A catch-all (called the default address in cPanel) receives email sent to any address at your domain that doesn't exist – anything@yourdomain.com lands in one mailbox. It sounds convenient, but it often causes more problems than it solves. This guide explains the trade-offs and safer options.
Before you start
Check your current setting in cPanel → Email → Default Address.
Pros
- You never miss mail sent to a mistyped address.
- You can invent addresses on the fly (for example
shopname@yourdomain.com) to see who leaks your address.
Cons
- Spam magnet – spammers send to random and guessed names (dictionary attacks); a catch-all accepts all of it.
- Backscatter – spoofed spam using your domain bounces to random addresses, which all land in your catch-all.
- Server load and reputation – accepting lots of spam increases load, and forwarding it elsewhere damages your IP reputation.
- Hidden mistakes – senders never learn they used a wrong address.
- Email verification problems – tools that check whether an address exists can't tell for catch-all domains, which can lower trust in your domain's addresses.
Recommended setting in cPanel
- Go to cPanel → Email → Default Address.
- Select the domain.
- Choose Discard the email while your server processes it by SMTP time with an error message ("fail").
- Save.
Rejecting at SMTP time tells legitimate senders the address doesn't exist, without creating backscatter.
On Postfix
A catch-all is a virtual alias such as @example.com catchall@example.com in virtual_alias_maps. Remove the line and run postmap to disable it; Postfix will then reject unknown recipients (with smtpd_reject_unlisted_recipient = yes, the default).
Safer alternatives
- Specific forwarders – create forwarders only for the addresses you need, like
sales@andbilling@. - Plus addressing –
you+shop@yourdomain.comis delivered toyou@yourdomain.comon servers that support subaddressing (cPanel supports it); great for tracking sign-ups. - Aliases for common typos – forward
inf@orsale@if you see real senders using them. - Temporary catch-all – enable it briefly during a migration to find addresses in use, then disable it.
FAQ: catch-all email
Will disabling the catch-all lose important mail?
Only mail sent to addresses that don't exist. Review the catch-all mailbox for a week first and create forwarders for any legitimate addresses you find.
Does a catch-all hurt deliverability?
Indirectly: more spam processed and forwarded can harm your server's reputation, and some verification tools treat catch-all domains as risky.
What is the cPanel "default address"?
It's cPanel's name for the catch-all setting that decides what happens to mail for unknown addresses.