- Security
Email Security Best Practices: How To Keep Your Email Program Safe
Here at Mailgun, our focus has always been on creating solutions that solve problems big and small… and this philosophy doesn’t stop at email validations. We wanted to make it easier to identify different types of addresses through our validation services, and we are pleased to announce that catch-all domain support is now available through Mailgun email validations.
A catch-all domain will accept all mail sent to any address at the domain and return a 250OK, but they will never return a bounce. They are also called “accept-all domains” due to this behavior. Catch-all domains are particularly hard to authenticate because addresses can never be identified as invalid or undeliverable. Note that Yahoo! Mail, one of the more popular email service providers, is not a catch-all domain. Though they always return a 250OK, they also return delayed bounces, which allows us to identify invalid addresses.
On the surface, this may skew your engagement numbers. Obviously if you’re sending emails to an individual, you expect them to have some degree of engagement. But invalid addresses at catch all domains will never engage, so you’re inadvertently driving down your click-through and open rates and harming your metrics.
B2B organizations have been using catch-all domains for years to obscure email addresses from organizations who may be prospecting or otherwise sending out cold outreach emails. But more recently, consumer ISPs like Verizon Media Group have started using catch-all domains for spam traps. The result? Hitting these will harm your sender reputation and can get you block-listed by ISPs. This can hurt, especially if you thought you were covered keeping bounces and complaints to a minimum.
Mailgun is in a unique position as both an ESP and a validations service. We have access to sending and engagement data from the 250 billion emails we send per year. We know what’s deliverable, what’s not and the overall engagement from users.
Our validation service identifies domains that never return bounces, and it marks those domains as catch-all. Before an address is returned as catch-all, we check our engagement history to see if that individual user has performed any actions, such as clicks, that would identify the address as a real user. When addresses show engagement at catch-all domains, we return those addresses as deliverable instead of catchall so that you don't remove valid emails from your lists unnecessarily.
Since catch-all addresses with no engagement cannot be identified as deliverable or undeliverable, you must consider your risk tolerance and list acquisition techniques.
If your email list was acquired through less reputable means, we recommend not sending to your catch-all addresses or taking a more methodical approach to testing these. We recommend segmenting the catch-all addresses into their own list and slowly sending to them over time, waiting for engagement information (requires open/click tracking to be enabled), and then moving addresses with engagement back into their main lists.
On the other hand, if you practice single opt-in (or preferably double opt in) and have confirmed that your subscribers are both real and agreed to receive your messages, It is likely safe to send to these addresses. Users who performed a double opt-in will show engagement, and they will not return as catch-all addresses unless they have not shown any engagement for an extended period of time. If this happens, you should consider implementing a re-engagement campaign. Any addresses that remain unengaged should then be removed from your list.
Catch-all domain checks help you keep your email programs healthy. They are essential for email validation practices, and Mailgun can support you as you seek to use them. Catch-all domain support and our other email validations services are available through our paid plans. Log into the Mailgun dashboard or sign up for free and check them out today!
Learn about our Deliverability Services
Looking to send a high volume of emails? Our email experts can supercharge your email performance. See how we've helped companies like Lyft, Shopify, Github increase their email delivery rates to an average of 97%.
Last updated on May 13, 2021
Email Security Best Practices: How To Keep Your Email Program Safe
Mailgun’s Active Defense Against Log4j
How to Conduct a Comprehensive Email Deliverability Audit
Email's Best of 2021
3 Secure Email Gateway Holes You Need to Close
COVID-19 Survey: How the Pandemic Has Affected Email Sending
Mailgun Validations Features Improved Performance for EU Customers
How To Build An Email List The Right Way
The Basics of Email Subdomains
The Science and Art of Gmail Deliverability
InboxReady x Salesforce: The Key to a Stronger Email Deliverability
Become an Email Pro With Our Templates API
Google Postmaster Tools: Understanding Sender Reputation
Navigating Your Career as a Woman in Tech
Implementing Dmarc – A Step-by-Step Guide
Email Bounces: What To Do About Them
Announcing InboxReady: The deliverability suite you need to hit the inbox
Black History Month in Tech: 7 Visionaries Who Shaped The Future
How To Create a Successful Triggered Email Program
Designing HTML Email Templates For Transactional Emails
InboxReady x Salesforce: The Key to a Stronger Email Deliverability
Implementing Dmarc – A Step-by-Step Guide
Announcing InboxReady: The deliverability suite you need to hit the inbox
Designing HTML Email Templates For Transactional Emails
Email Security Best Practices: How To Keep Your Email Program Safe
Mailgun’s Active Defense Against Log4j
Email Blasts: The Dos And Many Don’ts Of Mass Email Sending
Email's Best of 2021
5 Ideas For Better Developer-Designer Collaboration
Mailgun Joins Sinch: The Future of Customer Communications Is Here
Always be in the know and grab free email resources!
By sending this form, I agree that Mailgun may contact me and process my data in accordance with its Privacy Policy.