Catch-all domains

Some domains accept every recipient. A shop’s contact domain routing everything to one inbox, a university forwarding into a directory it validates later, a provider that has decided mailbox existence is nobody’s business — all of them answer 250 to RCPT TO for an address nobody has ever owned.

An acceptance is worth exactly as much as the destination’s refusals are. If a domain refuses nothing, its acceptance of your address establishes nothing about your address in particular.

How it is established

After a destination accepts the real recipient, the same session asks about one control address — sixteen random bytes at the same domain, an address nobody could plausibly own. What happens to that recipient is what the domain’s acceptance is worth:

Control address	accept_all	What an acceptance of the real recipient is worth
refused, specifically	no	The domain discriminates. An acceptance is real evidence.
accepted	yes	The domain accepts everything. An acceptance means nothing about the mailbox.
refused ambiguously, or nothing conclusive	unknown	Undetermined. Weighed as though it could be either.

An ambiguous refusal is unknown and never no, deliberately: a false no would let a catch-all acceptance be reported as deliverable, which is the worst error this service can make. A false unknown costs one grade of certainty and nothing else.

What it does to the verdict

A recipient accepted at a domain where accept_all is yes is risky, not deliverable, and carries ACCEPT_ALL_DOMAIN. The recommended action is allow_with_email_confirmation — which is the honest answer, because a confirmation message is the only thing that would distinguish the two cases.

Where accept_all is unknown, the result carries ACCEPT_ALL_UNKNOWN and the acceptance is discounted rather than trusted.

It is a property of the domain, and it is remembered

The state is stored per domain and reused. Two consequences worth knowing:

• The same domain is not re-established on every request. A control recipient in every session is a shape a destination learns to refuse, and one that would spend your allowance to re-learn something that rarely changes.
• A state that is trusted is refreshed before it expires, not after. A domain that stopped accepting everything is the expensive direction to be wrong in: until the record is corrected, every address there is answered risky when it could have been decided, and nothing about that looks wrong from outside.

Some providers are known to accept everything at their edge and are never probed at all. Those results carry SMTP_PROBE_SKIPPED_PROVIDER_POLICY and ACCEPT_ALL_DOMAIN: no session was opened, because one would have established nothing and cost the destination a connection.

What this is not

It is not enumeration. Exactly two recipients are named in a session — the one you asked about, and one nobody owns — and the engine has no way to name a third. Nothing here can be turned into a directory harvest, which is a property of the code rather than a promise about how it is used.