Verified Is Not Deliverable: Catch-All Domains and the Bounce Math

A verified email address is one an SMTP server did not reject during a probe. On catch-all domains that response is automatic, so the same acceptance comes back for a real mailbox and for a string of random characters. Vendors label that result differently, and the bounce lands on your sending domain either way.

Every verification tool answers a narrower question than the person buying it thinks. The question it answers is not "will a human read this", it is "did a mail server decline to reject this address during a short SMTP conversation". On an accept-all domain those two questions are not even correlated.

That gap is where cold-email reputations die. You upload a list, most of it comes back green, and the bounces arrive anyway on the domain you also send investor updates from.

Verification proves an address was not refused. It never proves a mailbox exists.

What is a catch-all domain?

A catch-all domain, also called an accept-all domain, is a domain configured to accept mail sent to any local part instead of rejecting unknown recipients. Mail to sales@, to jane.doe@ and to a string of random characters is all accepted at the SMTP transaction, whether or not a mailbox behind that address exists.

The setting is a routing choice, not a property of the company. Google Workspace catch-all routing can send inbound messages addressed to incorrect or nonexistent accounts to a designated user account or Google Group (Google Workspace Help). Microsoft 365 can do the opposite, rejecting invalid recipients at the service perimeter with a 550 5.4.1 response before the message reaches the rest of the filtering layers (Microsoft Learn).

Same probe, opposite answer. What your verifier learned was the tenant's configuration, not the state of the mailbox.

Why a verified address is not a deliverable one

SMTP was never designed to answer the question verifiers ask it. A probe issues RCPT TO and reads the response code: a 250 means the server accepted the recipient specification, and a 550 is normally used when the address is known to be undeliverable (RFC 5321, 2008). Neither code is a promise that a human receives anything.

M3AAWG says it directly in Sender Best Common Practices: even a correct email address is not guaranteed to receive a message, and receiving systems can reject or return mail synchronously or asynchronously (M3AAWG, 2026).

Asynchronously is the word that matters, and it is why verified emails still bounce. A server can accept your message during the transaction and generate the failure later, which is exactly the pattern a catch-all domain produces on addresses your tool marked safe.

Valid, risky, accept-all: the labels are vendor-specific

There is no shared definition of any status a verification tool returns. Catch-all domain email verification is where that shows up hardest, because each vendor picks its own name and its own inference policy for the same SMTP result.

Read the Emailable row against the Hunter row. Emailable may return Deliverable on an accept-all address. Hunter's documentation says an accept-all domain cannot confirm a specific mailbox at all. Both are internally consistent, and both are describing the same protocol behaviour. You are comparing two inference policies, not two measurements.

Any verifier reporting a confident status on a catch-all domain is inferring, not verifying. The inference can be useful, but it deserves less trust than a hard Invalid. The same caution applies to the confidence scores attached by email finder tools that guess a pattern like first.last@ and then verify their own guess.

The bounce math, with a worked example

Bounce risk is concentrated, not spread. Take a send of 1,000 addresses where 300 sit on catch-all domains and the other 700 returned hard statuses. Your entire bounce exposure lives in those 300, and the arithmetic runs away fast.

Those rows are arithmetic, not a measurement. Nobody can publish a reliable dead-mailbox rate for accept-all domains, because the probe that would produce the number is the one that does not work. The point is the concentration: a segment that is 30% of the list controls 100% of the surprise, and you cannot know which row you are on before you send.

✅ Good: Split the accept-all segment into its own send of 50 to 100 addresses, read the bounces, then decide whether the rest is worth the domain.

❌ Bad: Merge accept-all addresses into the main sequence because one vendor's label said deliverable.

Running that experiment on a domain you have not warmed compounds both problems at once, which is a separate discipline covered in cold email deliverability and domain warmup.

What bounce rate is acceptable for cold email in 2026?

The threshold that matters is not a rule of thumb, it is the mailbox provider's tolerance, because that is what governs whether your domain keeps reaching inboxes at all.

• What providers actually publish are complaint rates. Google tells senders to keep the spam rate reported in Postmaster Tools below 0.10% and to avoid 0.30% or higher (Google, 2024). Yahoo asks bulk senders to keep spam complaint rates below 0.3% (Yahoo Sender Hub, 2024).
• Bounces are the part you control before any provider computes a rate on you. M3AAWG recommends suppressing an address after consecutive bounces, generally at least two bounces over two weeks or more, while allowing for receiving-server errors (M3AAWG, 2026).
• The terms keep tightening. Outlook.com introduced stricter SPF, DKIM and DMARC requirements for domains sending more than 5,000 emails per day, with enforcement beginning May 5, 2025 (Microsoft, 2025).

Pick the number you will not cross before the send, not after. When a domain comes back accept-all, the cheaper move is usually finding company email addresses from sources that show their working, rather than guessing at one.

Why this matters for your raise

Every campaign you send leaves from the same domain, and often the same mailbox, as every other one. Burn that domain guessing at catch-all addresses in a 2,000-row prospect campaign, and the damage is not confined to that campaign: the next message that mattered lands in spam too. The cheaper discipline is to send fewer, better-qualified messages to accounts you have actually researched, so volume is not asked to do the work that qualification should be doing. That is the problem Causo is built for, working out which companies fit your profile and who inside them to approach, rather than inflating a list you then have to guess your way through.

FAQ

Why do verified emails still bounce? Verification tests whether a server declined to reject an address during a short SMTP conversation, not whether a mailbox exists. M3AAWG notes that even a correct email address is not guaranteed to receive a message, and that receiving systems can reject or return mail synchronously or asynchronously (M3AAWG). A message accepted at the transaction can therefore bounce minutes or hours later.

What is a catch-all domain? A domain configured to accept mail addressed to any local part instead of rejecting unknown recipients. Google Workspace administrators can route messages sent to incorrect or nonexistent accounts into a designated user account or Google Group (Google Workspace Help). Because that acceptance is automatic, a probe cannot tell a real mailbox from a typo.

Should you email risky or accept-all addresses? Only in a separate, small, monitored segment, never merged into the main sequence. Hunter says an accept-all domain always returns an OK response for arbitrary mailbox names, so it cannot confirm whether a particular mailbox is valid or safe to use (Hunter). Treat the label as an instruction to send carefully rather than a verdict on the person.

What bounce rate is acceptable for cold email? The thresholds mailbox providers publish are complaint rates, not bounce rates. Google tells senders to keep the spam rate in Postmaster Tools below 0.10% and to avoid 0.30% or higher (Google), and Yahoo asks bulk senders to stay below 0.3% (Yahoo). Treat bounces as the leading indicator you control, and suppress an address after consecutive failures, which M3AAWG puts at generally at least two bounces over two weeks or more.

How does email verification actually work? A verifier resolves the domain's mail servers and opens an SMTP conversation, issuing RCPT TO for the address and reading the response code. A 250 means the server accepted the recipient specification, while a 550 is normally used when the address is known to be undeliverable (RFC 5321, 2008). Every risk score and confidence level above those two codes is vendor inference, not protocol.

Related on the hub

• The 12-slide seed pitch deck that raised $187M: real teardowns — for when the playbook turns into a raise.
• Buying a Lead List vs Building One: Cost per Verified Contact 2026 — Related cold outreach guide.
• Filter Databases vs Research Agents: One-Sentence ICP Test — Related cold outreach guide.
• The H1 2026 Outbound Sales Tooling Report — Related cold outreach guide.