Detect catch-all Microsoft 365 mailboxes

Catch-all domains are the hardest case in email verification — and a big share of business domains run on Microsoft 365, where catch-all is common. A catch-all server accepts mail for every address, so the usual mailbox check gets a "yes" whether the mailbox is real or not. Until now, that meant BounceShift often had to return catch_all or unknown for these addresses: honest, but not the decisive answer you want.

We've closed a lot of that gap. BounceShift now confirms whether a specific mailbox actually exists on Microsoft 365 business domains, even when the domain is catch-all — turning many of those "we can't be sure" results into a clean valid or invalid.

What changes for you

• Fewer dead addresses slip through as "valid." A convincing-looking address on a catch-all Microsoft 365 domain that doesn't actually have a mailbox is now caught and marked invalid, instead of quietly passing as safe to send.
• More decisive results, less guesswork. Addresses that used to land in catch_all / unknown now come back with a confident verdict, so more of your list is clearly actionable.
• Your real contacts stay protected. If our records already show mail has been delivering to an address, that evidence still wins — so shared mailboxes, distribution lists, and aliases aren't wrongly flagged.

How it works

Instead of relying only on the SMTP conversation that a catch-all server deliberately makes uninformative, BounceShift asks Microsoft 365 directly whether the account exists in the organization's directory. It's a lightweight, privacy-preserving check — no email is ever sent — that sidesteps the "accept everything" wall a catch-all puts up. When Microsoft's answer isn't trustworthy (for example, organizations that use their own single sign-on), we don't guess: the address falls back to our existing reputation-and-signals scoring, exactly as before.

Do you need to do anything?

No. It's on by default for everyone, on both single checks and batch uploads — you'll simply see more confident results on Microsoft 365 business domains. It applies to organization domains hosted on Microsoft 365, not personal outlook.com or hotmail.com addresses.

This is the first step in a broader push to resolve catch-all domains across more providers. If you validate a lot of business lists, you should notice cleaner, more decisive results right away.