If you’ve spent any time worrying about catch-all domains, you’ve probably been told to watch out for Microsoft. The corporate IT reputation, the accept-all admin defaults, the sprawling Exchange setups – Microsoft 365 is the provider everyone points to when deliverability gets murky.<\/p>\n\n\n\n
Our data says that’s wrong.<\/p>\n\n\n\n
We looked at 799,218 distinct domains<\/strong> across roughly 15.9 million live SMTP verifications, and broke catch-all rates down by mailbox host. The result reverses the conventional wisdom: Google Workspace domains are catch-all 34.6% of the time, versus 18.1% for Microsoft 365.<\/strong> Google-hosted business domains are about 1.9\u00d7 more likely<\/strong> to be a catch-all, and that’s despite Microsoft 365 hosting more domains overall.<\/p>\n\n\n\n Here\u2019s what it means for anyone sending to business addresses.<\/p>\n\n\n\n A catch-all domain is configured to accept mail sent to any address at that domain, whether or not a real mailbox exists behind it. That’s the catch: verification can confirm the domain accepts mail, but it can never confirm the individual inbox. Every address comes back “accepted,” so a real person and a typo look identical from the outside. More on the risks and trade-offs here.<\/p>\n\n\n\n One framing note before the numbers: these are predicted-deliverability figures measured pre-send, not post-send bounce data.<\/em><\/p>\n\n\n\n Consumer freemail (personal Gmail, Outlook.com, and the like) is excluded here, it’s a single shared domain, so it tells you nothing at the domain level. This is strictly business-hosted domains: companies running their own domain on Google’s or Microsoft’s infrastructure.<\/p>\n\n\n\n For context, 26.7% of all domains in the sample are catch-all<\/strong>, so neither provider is “clean.” But the gap between them is large, consistent, and the opposite direction from what the deliverability folklore predicts.<\/p>\n\n\n\n A statistic isn’t an insight until you can say why<\/em>. Here’s the reasoning, and we’ll flag clearly where it’s mechanism versus inference.<\/p>\n\n\n\n 1. Google makes catch-all a one-switch decision.<\/strong> <\/p>\n\n\n\n In Google Workspace, routing all unmatched mail to a single address is a straightforward routing setting an admin can flip without much thought. Microsoft 365’s equivalent behavior is more often a deliberate connector or mailbox configuration. When the safe-feeling option (“don’t lose any mail”) is one click away, more admins take it. Lower friction, higher catch-all rate.<\/p>\n\n\n\n 2. The “never lose a lead” instinct.<\/strong> <\/p>\n\n\n\n A catch-all guarantees no message is ever rejected for going to the wrong address. For a small business, exactly the kind of org that picks Workspace for its simplicity, that feels like pure upside: every sales@, hello@, and misspelled name still lands somewhere. The downside (no way to verify a real mailbox exists) is invisible to the person flipping the switch.<\/p>\n\n\n\n 3. Who’s on each platform.<\/strong> This is the inference layer, so we hold it loosely: Workspace skews toward smaller, newer, leaner organizations, where one inbox catching everything is a feature, not a risk. Larger enterprises, more common on Microsoft 365, tend to have stricter mail governance and dedicated admins who turn accept-all off<\/em> precisely because it hides delivery problems. If that composition difference is real, it would push exactly the gap we see.<\/p>\n\n\n\n The honest version: points 1 and 2 are about how the platforms actually behave; point 3 is a reasonable read of the customer mix, not something the raw catch-all count proves on its own. Either way, the direction<\/em> is not in doubt, it shows up across 800,000 domains, not a rounding error sample.<\/p>\n\n\n\n If the story is “domains run by organizations are more catch-all,” the TLD breakdown should agree. It does:<\/p>\n\n\n\nWhat is a catch-all domain<\/h2>\n\n\n\n
The finding<\/strong><\/h2>\n\n\n\n
Mailbox host<\/strong><\/td> Share of domains flagged catch-all<\/strong><\/td><\/tr> Google Workspace<\/td> 34.6%<\/td><\/tr> Microsoft 365<\/td> 18.1%<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Why Google runs higher \u2014 the part the number doesn’t explain on its own<\/strong><\/h2>\n\n\n\n
It tracks with the TLD data, too<\/strong><\/h2>\n\n\n\n