Your Own Catch-All Domain

In short. A domain you own, pointed at a mailbox that accepts every name on it, gives you an endless supply of addresses no blocklist has heard of. The price is a yearly bill, half an hour of setup, and responsibility for a domain that now carries your logins. For a certain kind of person that beats any public throwaway service, this one included.

What a catch-all actually is

A mail server normally accepts messages for the addresses it knows about and refuses the rest. A catch-all configuration inverts that rule: whatever appears before the at sign is accepted, and it all arrives in one mailbox you read.

The consequence is that you never create an address. You invent it in the signup form, at the moment you need it, and mail to it works straight away because the server was already willing to take anything. hardware-store@yourdomain.example exists because you typed it. So does roof-quote-may@yourdomain.example. No setup step per address, no waiting, no ceiling on how many you use.

That is the whole trick. Everything below is consequences.

What you need to set one up

Three pieces, none of them exotic.

A domain, from any registrar. A mail provider whose plan includes catch-all delivery, which is normal on paid mailboxes and rare on free tiers, so check before you pay rather than after. And DNS records: an MX record pointing the domain at that provider, plus the SPF and DKIM entries the provider gives you.

The work itself is half an hour of clicking. The slow part is waiting for records to take effect, which can be minutes or most of a day depending on what the previous values were and how long they were cached for. Until it settles, mail either bounces or vanishes quietly, so this is not a thing to do an hour before you need to receive something important.

What it gives you that a public service cannot

The domain is unknown to everyone. Detection works on the part after the at sign, not on the name you chose, so a domain belonging to one person and listed nowhere simply looks like a small company. It does not appear in the lists that signup forms consult because nobody has any reason to add it. That immunity is not permanent in principle, but in practice a domain with one user never attracts the attention that gets a domain listed.

The mailbox is genuinely private. Nobody else can request the same address, because addresses on your domain are not handed out by anyone. Compare that with a guest mailbox on a shared public domain, where an address you picked by hand can be requested by a stranger later.

The addresses outlive the transaction. They work for as long as you keep paying for the domain, which makes them suitable for things a short-lived address is wrong for: banking, employment, anything with a password reset attached.

What it costs, honestly

Money, yearly and indefinitely: domain registration plus a mailbox plan. We are not going to quote figures, because registrar and provider pricing moves and a number written today would be wrong inside a year. Look them up when you decide.

Attention. DNS records are now yours to keep correct, and a provider migration means editing them again. Mail that stops arriving is your problem to diagnose, and the first symptom is usually silence rather than an error.

Responsibility, which is the part people underestimate. The domain holds your logins. If a renewal fails because a card expired, every password reset you own stops working at once, and the domain becomes available for someone else to register and receive those resets. That failure is worse than anything a disposable service can do to you, because a disposable address was never the recovery route for anything that mattered.

The trail you create by owning it

A shared public domain hides you among everyone else using it. Your own domain has exactly one user, and every address on it carries the same suffix.

Two companies comparing records, or two leaked databases that end up in the same hands, link your accounts together on the suffix alone. Unique names before the at sign do nothing about this: the domain is the identifier. Registration data adds to it, since privacy protection hides the public record but not the registrar's own, and the domain name itself often carries your surname or your business.

So a catch-all domain solves disposability completely and makes unlinkability worse. If your reason for using throwaway addresses is keeping separate accounts genuinely separate, weigh that carefully before buying anything.

Spam finds it, and then it floods

The first time an address on your domain appears in a leaked list, the spam does not stay on that address. Senders working from purchased data try common names against the domain, and a catch-all accepts all of them, so info@, admin@, sales@ and a few hundred dictionary words start delivering into the same mailbox you read.

This is why per-prefix control matters more than the catch-all itself. You need the ability to switch off shop-2024@ once it turns into a sewer, without touching anything else. Providers differ: some let you blackhole individual local parts, some only filter after delivery, some offer nothing. A catch-all with no way to kill a prefix degrades into a mailbox you stop opening, which is the same as not having one.

Who should not bother

Anyone who needs one confirmation code once. The setup takes longer than the task.

Anyone unwilling to administer mail. This is not heavy work, but it is permanent work, and it fails at inconvenient moments.

Anyone whose interest will not survive the first renewal. A domain abandoned after a year takes every account attached to it down with it, and that is a strictly worse outcome than having used a throwaway address in the first place.

Where this beats us, plainly

For someone who keeps accounts for years, wants one address per service, and is willing to own a small piece of infrastructure, a catch-all domain wins on every axis: not detected, not shared, not expiring, no advertising. We are not going to argue otherwise. The audiences barely overlap, and pretending a free public service replaces owned infrastructure would be the kind of claim that makes the rest of a site untrustworthy.

What we are for is the other case. A mailbox here opens in one click, lasts twenty four hours from last use, disappears the moment you ask for a new address, and costs nothing because advertising pays for it. No renewal, no MX record, no bill, nothing to remember. In exchange the domain is public and some forms will refuse it, you cannot send mail from here and never will be able to, and there is no API.

Between the two sits a third option worth knowing about: masking and relay services give you per-service addresses that forward to your real mailbox, with no domain to maintain. Weaker than owning a domain, sturdier than a throwaway address, and paid for with a subscription instead of your time.