A catch-all address scoops up every email sent to your domain that doesn't match an existing mailbox — typos, old contacts typing the wrong prefix, or someone guessing at sales@yourdomain.com when it doesn't exist yet. It sounds convenient. In practice, it's one of the more misunderstood settings in cPanel, and turning it on carelessly is a fast way to end up on a spam blacklist through no fault of your own. Here's how to set it up properly, and why most hosts — SkyServer included — recommend thinking twice before you do.
What a Catch-All Address Actually Does
Every cPanel account has a mail routing order: a message first tries to match an exact mailbox (like info@yourdomain.com), then any forwarders you've set up, and only if nothing matches does it fall through to the catch-all — also called the "Default Address" in cPanel's Email interface. If you haven't configured one, unmatched mail is bounced back to the sender with a "user unknown" error. If you set a catch-all, that unmatched mail gets delivered (or forwarded) instead of rejected.
That single behavior change — accept instead of reject — is where both the convenience and the risk come from.
How to Set It Up in cPanel
- Log into cPanel and open Email > Default Address (older themes list this under "Email Routing" or just "Default Address").
- Select the domain you want to configure, if your account hosts more than one.
- Choose Send to Email Address and enter where you want unmatched mail delivered — usually an existing mailbox on the same domain, like admin@yourdomain.com.
- Alternatively, choose Discard (not recommended, see below) or Forward to your system account if you want it dumped into a local Unix mailbox you check via SSH.
- Click Change to save.
That's the entire setup. The part that actually matters is what happens after mail starts arriving.
The Real Problem: Backscatter Spam
Spammers routinely send mail to random combinations of names at a domain — john@, info2@, accounts.payable@ — hoping something sticks. Without a catch-all, your server rejects those instantly at the SMTP level, before it ever accepts the message body. That's the correct, low-cost behavior.
With a catch-all pointed at Discard, your server accepts the message first (so it looks legitimate to the sending server) and then silently deletes it. That seems harmless, but if the "From" address on that spam was forged to look like a real person's email — which it almost always is — and your mail queue ever bounces a message for a different reason (mailbox full, temporary failure), the bounce notice gets sent to that forged, innocent address. This is called backscatter, and it's one of the more common ways a completely uninvolved cPanel account ends up flagged by spam-reputation services like Spamhaus or Barracuda.
If your catch-all forwards to a real mailbox instead of discarding, you avoid backscatter but trade it for a different problem: your inbox fills with junk mail sent to variations of addresses that were never supposed to exist, and it gets worse every month as more spam lists include your domain.
When a Catch-All Actually Makes Sense
| Situation | Recommendation |
|---|---|
| You just launched a new domain and aren't sure yet which addresses staff will use | Fine short-term, review weekly and create real mailboxes for anything legitimate |
| You've published a lot of printed material with inconsistent email formats over the years | Reasonable, but set an expiry reminder to disable it once migrations settle |
| You want a safety net for typos in customer-facing addresses | Better solved with 2-3 specific forwarders (sales@, info@, support@) instead of a catch-all |
| You're not actively monitoring the inbox it points to | Don't enable it — set it to Discard or leave it unset instead |
The Safer Alternative: Specific Forwarders
In most cases, what people actually want from a catch-all is coverage for a handful of predictable addresses, not literally every possible string before the @ sign. cPanel's Email > Forwarders tool handles this without the backscatter risk:
- Create individual forwarders for the addresses you expect people to guess —
info@,contact@,hello@. - Point them at one shared mailbox if you don't need them separated.
- Leave the Default Address unset (or on Discard), so genuinely random or malicious probes still get rejected outright.
This gets you 90% of the convenience of a catch-all with almost none of the spam exposure, because your server is still refusing mail for addresses nobody actually uses.
If You Already Have One Enabled and Suspect It's a Problem
Check Email > Email Deliverability in cPanel and look at recent bounces, or check WHM/server mail logs if you have access, for a spike in outbound bounce notices you didn't send. If you're seeing your domain's reputation drop or landing on a blacklist checker like MXToolbox, disabling a Discard-mode catch-all is usually the fastest fix — it stops your server from accepting mail that generates those bounces in the first place. Switch Default Address back to blank (Do Nothing / Fail) rather than Discard; a failed delivery bounces immediately at the connecting server, which doesn't create the backscatter problem the same way.
Prevention
- Default to no catch-all. Only enable one with a specific, temporary reason.
- If you must forward unmatched mail somewhere, forward to a monitored mailbox — never Discard silently on a domain that receives real customer email.
- Review the Default Address setting whenever you take over an account you didn't originally configure; it's a common leftover from a previous admin or a migration import that nobody revisited.
- Pair any catch-all with proper SPF, DKIM, and DMARC records on the domain, so at least outbound mail from your own server isn't what gets forged in someone else's spam run.
Frequently Asked Questions
Does a catch-all address slow down my mail server?
Not meaningfully on its own, but it increases the volume of junk mail your server processes, which can add up on accounts already close to their email sending/receiving limits in cPanel.
Can I have a catch-all for one domain but not others on the same account?
Yes. The Default Address setting in cPanel is per-domain, so you can enable it for one addon domain while leaving the primary domain and other addon domains without one.
Will a catch-all catch mail meant for an existing mailbox?
No. cPanel always checks exact mailbox matches and forwarders first. The catch-all only fires for addresses that don't match anything else you've configured.
Is "Discard" or "Do Nothing" the safer catch-all option?
Neither is truly safe, but if you're choosing between accepting-then-discarding versus not having a catch-all at all, leaving it unset (so unmatched mail bounces immediately) avoids backscatter better than accept-and-discard does.
How do I know if spammers are already hitting my domain with random addresses?
Check your mail server's logs (via WHM if you have root, or ask support if you're on shared hosting) for a high volume of connections to nonexistent addresses. A sudden jump usually means your domain landed on a harvested spam list, which is common after a WHOIS leak or a data breach unrelated to your hosting.
