In this guide · 8 sections
- 01What a catch-all email address does
- 02Pros and cons of a catch-all address
- 03Setting up a catch-all in Google Workspace
- 04Why Microsoft 365 doesn't do catch-all by default
- 05Better alternatives: aliases, groups and shared mailboxes
- 06If you keep a catch-all, make it safer
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
A catch-all delivers mail for any non-existent address at your domain to one mailbox. It stops you missing misspelt emails, but it also pulls in spam sent to made-up addresses and hides mistakes. Most small businesses do better with a few aliases and groups for the addresses people actually use.
What a catch-all email address does
Normally, an email sent to an address that doesn't exist at your domain, say infor@yourcompany.com.sg, bounces back to the sender with an error. With a catch-all, your mail system accepts it and delivers it to one chosen mailbox instead.
Google describes it in its catch-all routing help as a way to get messages sent to incorrect or non-existent addresses at your domain into a single mailbox.
Pros and cons of a catch-all address
The convenience is real, but so are the side effects:
Why people turn it on
- Misspelt addresses still reach you
- Old addresses of former staff keep receiving mail
- Quick way to test made-up addresses for sign-ups
- No need to set up every role address in advance
Why it often causes trouble
- Spam sent to guessed addresses all lands in your mailbox
- Senders never learn they used the wrong address
- Phishing aimed at made-up addresses like accounts@ gets delivered
- Mail for former staff may hold personal data nobody is handling
- Someone must read the catch-all, or it becomes a black hole
Spammers commonly send to guessed addresses at a domain (info@, admin@, random names) to see what gets through. A domain that rejects unknown addresses gives nothing away; a catch-all accepts everything, which can also tell spammers the domain will take any address.
Setting up a catch-all in Google Workspace
Google Workspace supports catch-all routing. Google's help page describes these steps, as of October 2026:
Choose the catch-all destination
An existing user, a new user, or a Google Group so several people can see the messages.
Open Gmail routing
Admin console, Apps, Google Workspace, Gmail, Routing. You need the Gmail Settings administrator privilege.
Add a routing setting
Name it, tick Inbound messages, choose Modify message, Change envelope recipient, and replace the recipient with your catch-all address.
Apply it to unknown accounts only
Under Show more options, tick All inactive and unrecognized accounts and leave Active user account and Group account unticked.
Save and test
Changes can take up to 24 hours. Send a test to a made-up address and confirm where it lands.
Google's page also shows a narrower option: an envelope filter so the setting only catches specific patterns, such as support@ and help@. That gives most of the benefit with far less spam.
Why Microsoft 365 doesn't do catch-all by default
Microsoft 365 has no catch-all setting. Instead, Exchange Online uses Directory-Based Edge Blocking (DBEB): if an address doesn't exist, the message is rejected at the edge, before spam and malware filtering, and the sender gets a bounce. Microsoft says DBEB is already in effect when all your recipients are in Exchange Online, with the domain set as Authoritative.
Workarounds posted online involve switching the domain to Internal relay and adding a mail flow rule that redirects mail for unknown recipients. That turns off the edge blocking for the domain and makes mail routing harder to troubleshoot. For most small businesses on Microsoft 365, aliases and shared mailboxes are the better route.
If you keep a catch-all, make it safer
Some businesses have good reasons, such as years of printed material with varying addresses. If you keep one:
Catch-all safety checklist
Do it yourself or get help?
Adding aliases and groups is a ten-minute job in either admin console. Catch-all routing in Google Workspace is a few more clicks, but the spam and data-handling consequences are worth thinking through first.
Our Business Email Setup (S$249) sets up Microsoft 365 or Google Workspace in your name with up to 5 mailboxes, aliases such as info@ and sales@, a shared inbox, and SPF, DKIM and DMARC records, with an admin handover so you own everything.
Frequently asked questions
A mailbox that receives any email sent to an address at your domain that doesn't exist. Instead of bouncing, a message to a misspelt or made-up address is delivered to the catch-all. It ensures typos reach you, but it also collects spam sent to guessed addresses and hides mistakes from senders.
Usually not for a small business. It tends to fill with spam and phishing sent to invented addresses, and senders never learn they used the wrong address. A few aliases for common misspellings and a group or shared mailbox for role addresses like info@ give most of the benefit without the junk.
Not as a normal setting. Exchange Online rejects mail to non-existent recipients by default using Directory-Based Edge Blocking. Workarounds involve changing the domain to Internal relay and adding a mail flow rule, which disables that edge blocking and complicates routing. Aliases and shared mailboxes are the recommended alternatives.
In the Admin console go to Apps, Google Workspace, Gmail, Routing, and add a setting for inbound messages that changes the envelope recipient to your catch-all address. Apply it only to inactive and unrecognised accounts. You can add an envelope filter so it only catches specific patterns. Changes can take up to 24 hours.
It is better not to. Mail for people who have left often contains customer and personal data, and a catch-all puts it in a mailbox nobody may be watching. Convert the leaver's mailbox to a shared mailbox or forward it to a manager for a fixed period, then let new messages bounce so senders update their records.