No — not without verifying them first.
A catch-all domain is one configured to accept every email sent to it, regardless of whether the specific address actually exists. That sounds convenient for the company running it, but for you as the sender it's a trap: you have no way of knowing upfront whether the address you found is real or just a black hole.
According to Scrubby — a catch-all verification vendor — including unverified catch-all addresses in your campaigns leads to an average 9% bounce rate, which is enough to seriously damage your domain deliverability. They also note that 23% of risky or catch-all emails from a typical lead list will hard bounce. That's not a rounding error; that's a deliverability emergency waiting to happen. (Disclosure: Scrubby sells catch-all verification services, so treat their figures as directionally useful rather than fully independent.)
The reason the damage compounds is the mechanism itself: many catch-all domains accept your email on arrival and then silently reject it later, generating delayed bounces. By the time you notice the pattern, ISPs have already started downgrading your sender reputation. The ripple effects hit every subsequent campaign — lower inbox placement, higher spam rates, and in the worst case, a blacklisted domain.
Here's the practical path forward:
- Run your list through an email verification tool before sending. Tools specifically built for catch-all resolution can flag which addresses are likely deliverable and which are high-risk.
- Send to unverified catch-alls in small, monitored batches if you absolutely can't skip them — watch bounce rates closely and pull any address that bounces before it compounds.
- Use dedicated sending domains for your outbound outreach (separate from your main business domain). This is standard infrastructure advice for cold email: if a sending domain gets burned, your primary business domain stays clean. Note this is about your sender setup — it's a separate question from whether a recipient's domain is catch-all configured.
- Authenticate your sending domains with SPF, DKIM, and DMARC — this is table stakes for deliverability regardless of catch-all risk.
The math is straightforward: catch-all addresses make up a significant portion of most B2B prospect lists, but sending to them blind is how you turn a healthy sending domain into a liability. Verify first, or leave them out.