Does a catch-all give me truly unlimited addresses?

Yes, in practical terms. Any address at a catch-all domain is accepted and delivered without being created first, so you can invent as many as you like across every domain you own.

Won't a catch-all drown me in spam?

It accepts more addresses, so it can let in more junk, but ordinary spam filtering still applies and distinctive address names defeat most guessing. For most people the leak-detection benefit outweighs the extra noise.

How is this better than plus-addressing?

Catch-all addresses look like normal addresses, so they can't be trivially stripped back to a base, and they work across all your domains rather than hanging off one. Plus-addressing is a single-mailbox trick; catch-all spans your whole portfolio.

Can I use catch-all on some domains and not others?

Yes. It's a per-domain choice. Enable it where convenience matters and stick to named addresses where you want tighter control.

Where does all this mail end up?

In one inbox on your own account, encrypted at rest with a key only you hold. Unlimited addresses across every domain still resolve to a single place you read, and the host stores ciphertext it cannot open.

Addresses & deliverability

The Catch-All Trick: Unlimited Email Addresses Across Every Domain

A password-reset request once landed at an address I had handed to exactly one company and nobody else. Its name was right there in the address; the sender was a stranger — which meant that company had leaked, sold, or lost my address, and I knew which one, to the day.

That is the catch-all payoff in a single story, and this is the playbook that makes it repeatable: the exact toggle that switches a catch-all on in Cloudflare, a naming scheme you can copy verbatim, the single filter and the leak forensics that turn one address into a tripwire, and an honest list of the names where you should leave it switched off.

What a catch-all is, precisely

Normally a mailbox only accepts the addresses you have created, and mail to anything else bounces. A catch-all inverts that rule for a whole domain: any address at that name is accepted and delivered to your inbox, whether or not you ever defined it. So on yourbrand.com, both hello@ and an address you invent at a checkout page mid-keystroke simply work — you never created either. The domain says yes to all of them and routes them to one place.

Key takeaway: A catch-all turns a domain into an infinite supply of addresses. You stop creating addresses and start spending them — any name, any time, delivered to one inbox.

Why it compounds across many domains

On one domain a catch-all is a convenience. Across a portfolio it becomes infrastructure. Every name you own turns into its own fresh pool of addresses, so you can sort services by domain — vendors on one name, personal signups on another, throwaway trials on a third — and still read all of it in one inbox. Twenty domains with catch-all is zero addresses to provision, because each address already exists the moment you type it. That is the real reason a catch-all and a growing collection of names belong together: the portfolio stops being more admin and starts being more room.

Switch it on: Cloudflare Email Routing

Before any of that pays off you have to turn the catch-all on, and it is a per-domain setting you flip at the routing layer — on Cloudflare a toggle, not a config file. For each domain you want it on:

In the Cloudflare dashboard, pick the domain and open Email → Email Routing. If the domain is new to it, Cloudflare walks you through pointing the mail at itself: it adds three MX records — route1.mx.cloudflare.net, route2.mx.cloudflare.net, and route3.mx.cloudflare.net — alongside the SPF record v=spf1 include:_spf.mx.cloudflare.net ~all, and you confirm a destination inbox by clicking a link it emails you.
Open the Routing rules tab and scroll to the Catch-all address block. It ships disabled on every domain, which is exactly why a fresh name silently bounces invented addresses until you come here.
Set its action to Send to an address, choose your verified destination, flip it to Enabled, and save.

That is the entire switch, and every address at that domain now resolves instead of bouncing. Repeat it per domain — Email Routing is scoped to one zone at a time — and point them all at the same inbox so the whole portfolio still lands in one place.

The naming scheme (copy this verbatim)

A catch-all only pays off if your addresses are systematic. Invent them at random and you lose the thread; follow one rule and every address announces who it belongs to. Here is the scheme, ready to adopt as-is.

First, pick a private token — two or three characters that mean nothing to anyone else, say qz. It is not a password; it is a mark that every address you deliberately hand out will carry. Then build every address the same way, service-token@domain:

netflix-qz@yourbrand.com for Netflix, landlord-qz@yourbrand.com for the landlord.
Multi-word service? Hyphenate it: blue-apron-qz@yourbrand.com.
Something high-stakes — a bank, your account-recovery address — earns a second random chunk so it can't be guessed from the pattern: chase-qz-4f@sidebrand.io.

The service name is simply what you'd call the company out loud. You never write these down in advance. You coin each one at the signup box, and the catch-all makes it real the instant you submit the form.

The one filter worth adding

With the scheme in place, add a single rule on top — and make it this page's rule, not a generic spam sweep. Route your high-stakes addresses, the ones carrying a second random chunk, straight into a priority lane so they never sit buried in the rest of the catch-all's traffic. In Sieve it is one line:

if envelope :matches "to" "*-qz-??@*" { fileinto :create "Priority"; }

Every bank-and-recovery address you coined in the chase-qz-4f shape now jumps to its own folder the instant it lands. That is the opposite move from drowning the inbox in rules: one filter, keyed on a mark you already put in the address, surfacing the mail you most need to see while ordinary service-qz addresses flow straight through.

Reading a leak, retiring an address

Because each address belongs to exactly one company, a leak outs itself. When mail turns up at netflix-qz@yourbrand.com from anyone who is not Netflix, that address is burned — someone downstream got hold of it. The repair is surgical:

Send the single address to the bin: route netflix-qz@ straight to trash.
Coin its replacement the next time you log in — netflix2-qz@ — and update that one account.
Leave every other address untouched. Nothing else is affected, because nothing else shares the name.

Try that with one shared address on an ordinary mailbox and your only options are to live with the spam or to re-paper every service you own with a new address. The per-service scheme hands you a scalpel instead of a sledgehammer.

Why not just use plus-addressing?

You may already lean on plus-addressing — the you+netflix@gmail.com trick, where everything after the + is ignored by delivery but visible to you. It helps, but it loses to a catch-all on the two things that matter here. The +tag is a well-known pattern: some forms reject it outright, and a data broker can strip it back to your real address in one step. A token address like netflix-qz@yourbrand.com looks like an ordinary address with no obvious base to strip to. And plus-addressing all hangs off one mailbox on one domain, advertising that single base to the world; a catch-all spreads your identities across every name you own.

When to leave catch-all off

Honesty cuts both ways, so here are the cases where a catch-all is the wrong call — or wants a named-address partner:

A heavily targeted name. If a domain already draws a flood of guessed-address spam, a catch-all hands all of it to you; named addresses stay calmer.
When you want typos to bounce. With a catch-all, a mistyped address lands silently in your inbox instead of bouncing, so a sender who got your address slightly wrong is never told.
Strict address discipline. Some workflows want only approved addresses to exist at all. That is a named-address job, not a catch-all one.

None of this is all-or-nothing. Catch-all is a per-domain switch, so you run it on the names where convenience wins and keep named addresses on the ones where control matters. Whichever mix you choose, every address still resolves to one inbox on your own account. Mail arrives in the clear and is encrypted the moment it is received, then held at rest under a key only you hold, so the host stores ciphertext it cannot open — not a claim that anything is unbreakable, and sending still rides on a provider that relays it. The addresses multiply; the place you read them does not.

Does a catch-all give me truly unlimited addresses?: Yes, in practical terms. Any address at a catch-all domain is accepted and delivered without being created first, so you can invent as many as you like across every domain you own.
Won't a catch-all drown me in spam?: It accepts more addresses, so it can let in more junk, but ordinary spam filtering still applies and distinctive address names defeat most guessing. For most people the leak-detection benefit outweighs the extra noise.
How is this better than plus-addressing?: Catch-all addresses look like normal addresses, so they can't be trivially stripped back to a base, and they work across all your domains rather than hanging off one. Plus-addressing is a single-mailbox trick; catch-all spans your whole portfolio.
Can I use catch-all on some domains and not others?: Yes. It's a per-domain choice. Enable it where convenience matters and stick to named addresses where you want tighter control.
Where does all this mail end up?: In one inbox on your own account, encrypted at rest with a key only you hold. Unlimited addresses across every domain still resolve to a single place you read, and the host stores ciphertext it cannot open.

#CatchAllEmail #UnlimitedAddresses #EmailPrivacy #MultipleDomains #CustomDomainEmail #SelfHostedEmail #EncryptedEmail #EmailAliases