Catch-All Email Address: Your Domain as a Leak Detector

Picture this: an address you only ever gave to one electronics retailer starts receiving gambling spam. A week later the retailer emails you about “a security incident at one of our suppliers”. You already knew. That’s the whole idea behind a catch-all email address on your own domain, and it catches things breach databases never will, because most data sharing never makes the news.

How a catch-all email address works

A mail server normally accepts mail only for addresses that exist. Everything else is refused with 550 5.1.1 User unknown. With a catch-all, any message to your domain lands in the destination mailbox, whatever comes before the @.

You no longer create addresses in advance. You make them up when you sign up:

The q4 suffix is optional but useful. If someone knows you use a catch-all, they can’t simply guess [email protected] and send you a convincing fake.

The leak detector in practice

If spam or phishing reaches energy-q4@, there are three explanations: the supplier was breached, it shared your address, or one of its contractors was breached. Either way you know who to ask. In the EU and UK you can use a GDPR subject access request to find out who your data was passed to.

This complements breach services like Have I Been Pwned, which only know about leaks that became public. How those work is in check if your email was in a data breach.

Phishing gets easier to spot, too. A “bank” email sent to the address you gave a trade magazine is fake. No further analysis needed.

Setting up catch-all

Most mail providers that support custom domains offer it as a toggle, often labelled “catch-all”, “alias” or “unknown recipients”. On your own Postfix server, one line in /etc/postfix/virtual does it:

@example.com          [email protected]

sudo postmap /etc/postfix/virtual
sudo systemctl reload postfix

This assumes virtual_alias_maps = hash:/etc/postfix/virtual is set in main.cf and the domain is configured as a virtual domain. More specific entries take priority, so real addresses aren’t swallowed by the catch-all.

Nothing changes in DNS. What matters is that the MX record points to the right server:

$ dig +short MX example.com
10 mx.mailprovider.example.

Keeping the spam under control

The objection to catch-all is fair: you accept everything, including dictionary attacks on info@, admin@ and accounts@. Three rules keep it manageable.

First, reject burned addresses rather than filtering them. In Postfix, an access table in /etc/postfix/recipient_access makes the server refuse the address during delivery:

[email protected]   REJECT address retired

Hook it in with check_recipient_access hash:/etc/postfix/recipient_access under smtpd_recipient_restrictions, then run postmap on the file.

Second, put the catch-all on a subdomain. Instead of *@example.com, use *@in.example.com. Spammers rarely guess subdomains, and your main addresses stay clean. The subdomain needs its own MX record.

Third, add one folder rule: anything not addressed to one of your fixed addresses goes into a “Services” folder. Your inbox stays readable.

Catch-all, alias service or plus addressing?

There are three common ways to use a separate address per service. The real difference is who ends up owning the addresses.

Alias services, some built into password managers and mail apps, are convenient and hide your real address completely. The catch: if the service disappears or you switch, your accounts hang off addresses you no longer control. With your own domain you move the MX records to a new mail provider and every address keeps working. For accounts you plan to keep for years, that settles it.

What catch-all can’t do

It doesn’t protect accounts. A leaked password is leaked, whatever address it was attached to. What to do then is in email in data breach: what to do. For unique passwords you need a password manager, which can store the matching address in the same entry.

And a domain with dozens of accounts hanging off it becomes a valuable target in its own right. If it expires and someone else registers it, they can click “forgot password” for every address you ever used. How to prevent that is covered in account recovery email on your own domain.

Which domain to use

Any domain will do; it doesn’t need to be pretty. Some people use their surname as a .com or .me, others a short made-up name used only for sign-ups, which reveals nothing about who they are.

At betadomain a .me domain is €24.99 a year and a .com €14.99, renewing at the same price, as the price list shows. Check whether your name is free, and switch on auto-renewal the day you register so the domain never lapses by accident.

Step by step

1. Get a domain and a mailboxYou need a domain whose MX records point to a mail provider that supports catch-all, and a destination mailbox.
2. Switch on catch-allEnable the option for unknown recipients in your provider, or on Postfix add an @yourdomain entry to virtual_alias_maps.
3. Pick a naming schemeUse the service name plus a short private suffix for each address, so nobody can guess your other addresses.
4. Use one address per serviceEnter the matching address whenever you sign up, and save it with the login in your password manager.
5. Block burned addressesWhen spam reaches a service address, check whether that service reported a breach, reject the address at the server and give the service a new one.