Every Address Is Valid Until It Isn't: Auditing the Accept-All Signup Form

There is a particular kind of optimism baked into the modern signup form. Type anything into the email field, hit submit, and the system says: lovely, you're in. No verification, no probing, no awkward conversation about whether that mailbox actually exists. It feels polite. It also means your database is now a suggestion box that anyone with a script can post into.

Catch-all domains are where that optimism gets formalised. The mail server accepts anything addressed to the domain, whether or not a human is behind it. Signup bots work this out fast, and once they do, the form becomes a free provisioning service for junk.

The friendly lie of "any address will do"

A catch-all is sold as a safety net. The logic runs: a real customer with an unusual address shouldn't be turned away because our validation is too clever. Genuinely fair. But a catch-all cannot tell the difference between a new customer called Priya and a dictionary attack cycling through first names. It just keeps saying yes.

Add to that the role account — info@, sales@, accounts@, admin@, noreply@ — which appears in every footer, on Companies House filings and in a decade of PDFs nobody can find. These mailboxes are almost never tied to one named person, which is fine right up until something goes wrong.

And then there's the disposable layer: plus-addressing, throwaway providers, ten-minute temp mail. Worth saying plainly, because a lot of filter rules get this wrong — plus-tags are a privacy feature used by entirely reasonable people. Treat them as a signal, not a crime.

What a catch-all actually swallows

Three problems arrive in the same envelope.

First, list quality. Signups that never open anything drag your engagement metrics down, and inbox providers increasingly judge you by how your recipients behave rather than how pretty your SPF record is. A list padded with bots teaches the algorithms that your mail is easy to ignore.

Second, traps. Addresses that were abandoned years ago and have since been recycled, or addresses that never belonged to anyone and exist purely to catch list-builders, do not complain — they simply report. A catch-all has no defence against accepting them.

Third, complaints. Real people who get mail they never asked for hit the spam button rather than hunting for an unsubscribe link. Keep that rate low; it is one of the few numbers that will end your sending reputation regardless of how clean your DNS looks.

Role accounts: shared, invisible, unowned

The deliverability side gets all the attention, but the operational side is worse. If a breach hits and you need to notify affected users, a catch-all means you may send a breach notice to an address that was never verified and never belonged to a customer. That is an uncomfortable sentence to write in a report to the ICO.

Role accounts create their own version of the problem. Who holds the password for accounts@? Is MFA on it? Is it a shared mailbox with four delegates and no audit trail? A subject access request or an erasure request landing in a mailbox nobody owns is how small compliance problems become large ones.

A five-step audit for UK teams

1. Inventory the domains. Every domain and subdomain you own, including the marketing one from a 2019 campaign that everyone forgot. Check MX records. Find the catch-alls you didn't know about.
2. Map role accounts to named owners. One human, one escalation path, MFA enforced, listed in the same ticket system as everything else.
3. Count signups per source, per day. Bots leave a signature: a spike from one subnet, one form, one user agent, or a completion time under two seconds.
4. Measure the dead weight. What proportion of new signups never open a single message? Anything above a third is worth a hard look at the form.
5. Check what your verification actually does. Syntax-only checks catch typos and nothing else. Live SMTP probing is unreliable because half the internet blocks it. A confirmation token is the only method that proves a human wanted the mail.

Filter rules that sort the humans from the junk

On the form side, score rather than reject. Disposable domain lists, a hidden honeypot field, completion speed, geographic mismatch between IP and stated country — each is weak alone, useful together. Rate-limit per IP and per subnet, and put a proof-of-work or CAPTCHA in front of bursts rather than in front of everyone.

On the mail gateway side, stop letting catch-all traffic skip your spam checks. Apply stricter content thresholds to catch-all recipients, and quarantine rather than reject for the first month so you can see what you would have lost. Refuse role accounts at signup with a friendly message pointing at a named contact — the conversion cost is tiny compared to the mess.

Require confirmation before adding anyone to anything that could read as marketing. Under PECR you need to be able to show consent, and "they typed it into a box once" is a thinner defence than it feels at the time.

Finally, watch your outbound. A domain that accepts billing@ will attract invoices, some of them fraudulent. That is a separate article, but the two problems share a root cause.

Honest beats permissive

None of this means slamming the door. It means saying no to the right things and explaining why. A signup form that verifies, that declines role accounts, and that tells bots to get lost is not unfriendly — it is the difference between a mailing list and a landfill.