We analyzed 800,000 domains to find the biggest catch-all offender 

If you’ve spent any time worrying about catch-all domains, you’ve probably been told to watch out for Microsoft. The corporate IT reputation, the accept-all admin defaults, the sprawling Exchange setups – Microsoft 365 is the provider everyone points to when deliverability gets murky.

Our data says that’s wrong.

We looked at 799,218 distinct domains across roughly 15.9 million live SMTP verifications, and broke catch-all rates down by mailbox host. The result reverses the conventional wisdom: Google Workspace domains are catch-all 34.6% of the time, versus 18.1% for Microsoft 365. Google-hosted business domains are about 1.9× more likely to be a catch-all, and that’s despite Microsoft 365 hosting more domains overall.

Here’s what it means for anyone sending to business addresses.

What is a catch-all domain

A catch-all domain is configured to accept mail sent to any address at that domain, whether or not a real mailbox exists behind it. That’s the catch: verification can confirm the domain accepts mail, but it can never confirm the individual inbox. Every address comes back “accepted,” so a real person and a typo look identical from the outside. More on the risks and trade-offs here.

One framing note before the numbers: these are predicted-deliverability figures measured pre-send, not post-send bounce data.

The finding

Consumer freemail (personal Gmail, Outlook.com, and the like) is excluded here, it’s a single shared domain, so it tells you nothing at the domain level. This is strictly business-hosted domains: companies running their own domain on Google’s or Microsoft’s infrastructure.

For context, 26.7% of all domains in the sample are catch-all, so neither provider is “clean.” But the gap between them is large, consistent, and the opposite direction from what the deliverability folklore predicts.

Why Google runs higher — the part the number doesn’t explain on its own

A statistic isn’t an insight until you can say why. Here’s the reasoning, and we’ll flag clearly where it’s mechanism versus inference.

1. Google makes catch-all a one-switch decision. 

In Google Workspace, routing all unmatched mail to a single address is a straightforward routing setting an admin can flip without much thought. Microsoft 365’s equivalent behavior is more often a deliberate connector or mailbox configuration. When the safe-feeling option (“don’t lose any mail”) is one click away, more admins take it. Lower friction, higher catch-all rate.

2. The “never lose a lead” instinct. 

A catch-all guarantees no message is ever rejected for going to the wrong address. For a small business,  exactly the kind of org that picks Workspace for its simplicity, that feels like pure upside: every sales@, hello@, and misspelled name still lands somewhere. The downside (no way to verify a real mailbox exists) is invisible to the person flipping the switch.

3. Who’s on each platform. This is the inference layer, so we hold it loosely: Workspace skews toward smaller, newer, leaner organizations, where one inbox catching everything is a feature, not a risk. Larger enterprises, more common on Microsoft 365, tend to have stricter mail governance and dedicated admins who turn accept-all off precisely because it hides delivery problems. If that composition difference is real, it would push exactly the gap we see.

The honest version: points 1 and 2 are about how the platforms actually behave; point 3 is a reasonable read of the customer mix, not something the raw catch-all count proves on its own. Either way, the direction is not in doubt, it shows up across 800,000 domains, not a rounding error sample.

It tracks with the TLD data, too

If the story is “domains run by organizations are more catch-all,” the TLD breakdown should agree. It does:

The organization and institution heavy TLDs cluster at the top — .au, .edu, and .co all clear 32%. The pattern is consistent with the provider finding: the more a domain belongs to an entity running its own mail setup, the more likely accept-all is switched on.

What this actually means for your sends

This isn’t trivia. It changes how you should read your own list.

If your audience is B2B and Google-Workspace-heavy i.e. startups, agencies, small tech companies, a larger slice of your list is catch-all than provider reputation would lead you to expect. Those addresses aren’t invalid, but they’re unconfirmed: verification can tell you the domain accepts mail, not that the specific person exists. Treat that slice as a question mark, not a green light.

Concretely:

• Segment the catch-all addresses out and send to them separately, in smaller volumes, watching engagement before you scale. The ones that open and click are real; the silent ones are suppression candidates, same as any unengaged contact.
• Don’t assume “business domain = safe.” A list of Workspace business addresses can carry a third-or-more catch-all load. That’s a real chunk of volume going to mailboxes you can’t confirm, and sustained sends into nowhere are what erode sender reputation for your whole list, valid addresses included.

Catch-alls are genuinely hard — a single SMTP pass can confirm the domain but not the mailbox, which is why most verifiers (us included, on a standard check) hand them back unresolved. They don’t have to stay that way. When we re-run the same addresses with Deep Scan, about half of the previously “unknown” addresses get a definitive verdict — turning roughly 4 in every 100 into newly usable, confirmed contacts. It won’t make a true catch-all stop being a catch-all (that’s a real domain-level property, and pretending otherwise would just be guessing), but it does shrink the unconfirmed pile you’re stuck managing by hand.

The methodology, because the whole point is rigor

Catch-all rates here come from a 48-hour sample of approximately 15.9 million live SMTP verifications, covering 799,218 distinct domains. Each figure is the percentage of domains exhibiting catch-all (accept-all) behavior. Consumer freemail is excluded from the per-host breakdown. All figures reflect predicted deliverability measured pre-send, not observed post-send bounces.

Most catch-all numbers in circulation aren’t tied to a sample size at all.

If you want to know your own exposure, run your list through EmailListVerify and catch-all domains get flagged and sorted automatically, so you can decide what to keep before it costs you.