To set up catchall email, choose the service that will receive mail for your domain, point the domain’s MX records to that service, verify the destination mailbox if required, and create a rule for unmatched recipients. Test a deliberately nonexistent address before relying on the setup.
A catch-all handles inbound mail sent to addresses that have not been created or were mistyped. It does not automatically provide spam protection or permission to send as every address on the domain.
As an Amazon Associate I earn from qualifying purchases.
What catchall email does
A catch-all, also written “catchall,” is an inbound rule for a domain. When a message is addressed to a local part that has no specific mailbox, alias, or route, the receiving service sends it to one configured destination. For example, a message to [email protected] can be delivered to [email protected] even though typo was never created.
This is useful when customers may mistype an address, when a small organization wants to monitor unconfigured addresses, or when a domain is being migrated and unknown recipients need temporary handling. The trade-off is volume: the rule also accepts more unwanted or misdirected mail than a list of explicitly configured addresses. Treat the destination as an inbox that needs monitoring and filtering, not as a guarantee that every message is legitimate.
#1 Best Overall
Choose the mail architecture before touching DNS
Only one mail-receiving architecture should be authoritative for a domain at a time. MX records tell senders where to deliver inbound mail; two independent services cannot both control the same domain’s unmatched recipients simply because both have a catch-all setting.
| Approach | How it works | Decisions to make |
|---|---|---|
| Hosted mailbox service | The provider receives mail, stores it in a mailbox, and applies its own routing rules. | Confirm the provider’s MX records, mailbox or plan requirements, and where the catch-all address will be hosted. |
| Forwarding to an existing mailbox | The routing provider accepts mail for the domain and forwards unmatched messages to an already-used address. | Verify the destination address, understand how forwarded mail is handled, and configure outbound sending separately if you need to reply as the original address. |
| Existing mail service with a routing rule | Your current provider remains the MX destination and rewrites or redirects messages for unknown recipients. | Use that provider’s documented routing screen and do not add a second provider’s MX records unless you are intentionally migrating. |
Before changing anything, inspect the domain’s current MX records and identify which service is supposed to accept mail. If the domain already has working mail, record the current values and plan the change so you do not interrupt known addresses.
Prerequisites and DNS checks
- Administrative access to the domain’s DNS zone.
- Administrative access to the chosen email or forwarding service.
- A destination mailbox that can receive the forwarded messages.
- A test address that does not exist, such as
[email protected]. - A record of existing MX, SPF, DKIM, and DMARC entries before editing them.
Use the exact MX values supplied for your account and provider. Cloudflare’s troubleshooting guidance specifically says to use the receiving provider’s correct MX values. Microsoft’s Microsoft 365 setup guidance is a useful illustration of the rule: it supplies Microsoft-specific MX and SPF configuration and instructs administrators to remove other MX records when completing that domain setup. Those values are not universal; copying them to a different service can stop mail delivery.
Authentication records need the same discipline. SPF authorizes sending services, DKIM signs outgoing messages, and DMARC tells receiving systems how to evaluate those signals. A catch-all is an inbound route, so enabling it does not by itself authorize outbound mail. Keep records for every service that actually sends mail, and use the selected provider’s current instructions. Cloudflare advises merging its SPF requirement with an existing SPF record rather than publishing multiple conflicting SPF records.
Set up catch-all with Cloudflare Email Service
Cloudflare’s Email Service requires the domain to use Cloudflare DNS. Cloudflare states: “You must be using Cloudflare DNS to use Email Service.” Follow the current onboarding instructions at Cloudflare’s route-email setup documentation; dashboard labels can change.
Rank #2
1. Confirm Cloudflare is authoritative for DNS
In your registrar or DNS management account, verify that the domain’s nameservers point to Cloudflare. If another DNS host is authoritative, Cloudflare’s Email Service onboarding cannot manage the required records until the DNS arrangement is changed.
2. Start Email Service onboarding
- Open Cloudflare’s Email Service onboarding and select the domain.
- Review the records Cloudflare proposes to add. The onboarding can include MX records for incoming routing and TXT records used for SPF and DKIM.
- Apply the records only after confirming that Cloudflare, rather than another provider, is meant to receive the domain’s inbound mail.
Cloudflare says DNS updates usually take 5–15 minutes for domains using Cloudflare DNS, but propagation can take up to 24 hours globally. These are estimates, not guarantees, and resolvers may see old and new answers during the transition.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match3. Add and verify the destination
Add the mailbox that should receive unmatched mail. Cloudflare sends a verification message to that address; complete the verification before attempting to create the catch-all route. A destination that has not been verified will not be available for the forwarding rule.
4. Enable the catch-all rule
- Open Cloudflare’s Routing Rules area for the domain.
- Enable Catch-all.
- Choose the action that forwards the message.
- Select the verified destination address, or select a Worker when your design uses a Worker as the destination.
- Save the rule.
Cloudflare describes a routing rule as a pairing between an email pattern and a destination. Its catch-all setting forwards every message sent to the domain, including misspelled local parts. The documented catch-all entries apply to apex domains only, so do not assume that enabling the apex rule automatically covers a subdomain.
5. Test a nonexistent recipient
Send a message from an unrelated account to an address that you have not created. Confirm that it reaches the verified destination and that an existing mailbox still behaves normally. Test at least one known address as well; a catch-all should handle unmatched recipients without replacing your explicit routes.
Rank #3
- Used Book in Good Condition
Set up catch-all routing in Google Workspace
Google Workspace documents a separate Gmail routing procedure for messages sent to incorrect or nonexistent addresses. Use the Google Admin console rather than translating another provider’s dashboard instructions.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Sign in to the Google Admin console with an administrator account.
- Go to Apps > Google Workspace > Gmail > Routing.
- Create a routing rule for messages whose recipients are incorrect or nonexistent.
- Configure the rule to modify the message and replace the recipient with the chosen catch-all address.
- Save the rule, allow the setting to become active, and test with a deliberately unconfigured address.
The exact options shown can depend on the current Admin console interface and account configuration. Keep Google Workspace’s MX records authoritative for the domain if Google is the service receiving mail; do not add Cloudflare or another provider’s inbound MX records merely to obtain a catch-all.
Provider-neutral setup for other services
If you use a different hosted email provider, the sequence is consistent even though labels and record values differ:
- Find the provider’s current domain-setup page and identify its required MX records.
- Compare those values with the domain’s existing MX records and decide whether the provider is replacing the current receiver.
- Publish the provider’s verification, SPF, DKIM, and any other required DNS records exactly as documented.
- Verify the destination mailbox if the provider requires confirmation.
- Create the provider’s rule for an unmatched, unknown, or misaddressed recipient.
- Send test messages to both a known address and a nonexistent address.
Some services call the feature “catch-all,” while others describe it as a default route, unknown-recipient rule, or misaddressed-recipient rewrite. Search the provider’s documentation for those terms, but do not infer that a similarly named setting has the same scope. Confirm whether it covers an apex domain, a subdomain, or only a particular mailbox group.
DNS authentication without breaking existing mail
MX records: select one inbound authority
MX records determine where senders deliver mail. If the records point to the wrong service, a perfectly configured catch-all rule will never see the message. Remove obsolete MX values only when the selected provider’s migration instructions call for it, and check that all required priority values are present.
Rank #4
SPF: merge, do not duplicate
A domain should not publish several independent SPF records for the same name. If the domain already sends mail through another service, merge the provider’s SPF mechanism into the existing record according to that provider’s syntax. Cloudflare specifically warns administrators to merge its SPF requirement with an existing SPF record. Use the current value for your account rather than an example copied from another domain.
DKIM and DMARC: match real sending services
Publish the DKIM selector and key supplied by the service that sends mail. Set DMARC with an understanding of every legitimate sender and any forwarding behavior. Inbound catch-all delivery does not create DKIM keys, SPF authorization, or DMARC policy for you.
Keep a change record
Write down the previous and new MX, SPF, DKIM, and DMARC records, the time of the change, and the intended receiving service. This makes rollback and troubleshooting possible when several DNS changes are made during a migration.
How to test the finished configuration
- Choose an address that is definitely not configured, using a distinctive local part.
- Send a plain-text test message from an account outside the domain.
- Confirm arrival at the catch-all destination and note the delivery time.
- Send a second test to an existing mailbox or alias to ensure explicit routing still works.
- Inspect the provider’s routing log or message trace, if available, when a test does not arrive.
- Repeat after DNS changes have had time to propagate if the first test was made immediately after editing records.
Test from more than one external sender when practical. A single successful message proves that one path worked; it does not prove that every sender has refreshed its DNS cache.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Troubleshoot common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| No message reaches the destination | MX records still point to another service, or DNS has not propagated. | Compare public MX results with the receiving provider’s documented values and allow for propagation. |
| Known addresses work but unknown ones bounce | The catch-all or unknown-recipient rule is disabled, scoped incorrectly, or unsaved. | Reopen the provider’s routing screen, confirm the rule is active, and verify that the test address matches its scope. |
| Cloudflare will not let you select the destination | The forwarding address has not completed verification. | Find the verification email, complete it, and then return to Routing Rules. |
| Mail works intermittently after a DNS edit | Different DNS resolvers still hold the previous records. | Check authoritative records, wait for propagation, and avoid repeatedly switching MX values while testing. |
| Outgoing mail fails authentication | SPF, DKIM, or DMARC does not include the service that actually sends the message, or duplicate SPF records exist. | Merge SPF requirements, publish the sender’s DKIM record, and review DMARC against the real sending path. |
| The rule receives a large amount of unwanted mail | A catch-all accepts every unmatched recipient, including accidental or abusive addresses. | Apply the receiving service’s filtering and retention controls, monitor volume, and disable the rule if the operational cost outweighs its benefit. |
Microsoft’s guidance estimates that its DNS changes typically take about 15 minutes, with longer delays possible. Treat that as a provider estimate rather than a universal deadline; DNS timing varies by resolver, record TTL, and the change being made.
Scope, security, and maintenance decisions
Catch-all is not a mailbox generator
The rule routes mail for unknown recipients; it does not create separate inboxes, user accounts, or aliases for every spelling. If an address needs its own identity, permissions, or reply history, create an explicit mailbox or alias instead.
Inbound routing is not outbound identity
Receiving a message addressed to [email protected] does not automatically let the destination send a reply with that address in the From field. Configure approved sending identities and authentication with the provider that will send the reply.
Decide how long to keep the rule
Catch-all is useful during migrations and for small domains, but it can hide typing errors and consume storage. Review the destination periodically, look for recurring unknown addresses that deserve explicit aliases, and remove the rule when the migration or monitoring purpose ends.
Recommended Free Tools
Check provider eligibility and current labels
Plan requirements, allowed destination types, and dashboard names can change. Cloudflare documents a verified address or a Worker as possible destinations for its routing rules, while other providers may allow only a mailbox or may restrict the feature to certain editions. Confirm eligibility and current instructions before making a production change.
Quick Recap
Quick decision checklist
- Which service is supposed to receive inbound mail for the domain?
- Do the public MX records point only to that service?
- Is the destination mailbox verified?
- Does the provider’s rule cover the apex domain, the intended subdomain, or both?
- Have SPF, DKIM, and DMARC been aligned with every actual sending service?
- Was a nonexistent address tested from outside the domain?
- Is someone responsible for monitoring the additional unwanted or misdirected mail?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
