How does a catch-all mailbox work?
A catch-all mailbox is a feature, or more precisely a special mailbox, that delivers messages sent to non-existent addresses within your
domain. This means that practically all messages sent to non-existent mailboxes are delivered to one mailbox that you designate as the catch-all mailbox. In practice, you can have your main mailbox info@yourcompany.cz that also serves as the catch-all mailbox, and it will also receive emails sent to anything@yourcompany.cz, even though the mailbox anything@yourcompany.cz has not been created.
This feature can be useful if, for example, you do not need or want to define individual mailboxes and just want one place where you receive all emails. Typically, if one person manages the mailbox but, for organizational reasons, has several addresses within the domain (eshop@yourcompany.cz, inquiries@yourcompany.cz, etc.), a catch-all mailbox is one solution. It can also be a good fit if there is a chance that a sender will make a typo in the address they send to, which is the case with mailbox names that are harder to remember. The sender should normally receive a bounce message, but it may not be obvious at first glance that the address they wanted to write to does not exist, and senders often ignore such messages. With a catch-all mailbox, you can collect these misaddressed emails so they do not get “lost”.
Risks of using a catch-all mailbox
If you use the catch-all feature on one of your mailboxes, that mailbox may become the target of a so-called “spam attack”, meaning your catch-all mailbox is flooded with bounce messages about spam supposedly sent from your mailboxes.
This happens when a spammer sends a large amount of spam and forges mailbox names on your domain as the sender. Because the recipient addresses are most often generated automatically, most of the target mailboxes do not exist. When delivery fails, an error report is sent back to the address listed as the sender, which is your address. It is essentially impossible to prevent this kind of forged mailing. The situation is very similar to regular mail, where you can write any address on the envelope as the sender.
Because the sender of these messages is usually a non-existent mailbox on your domain, all these bounce messages are sent to the mailbox set up as the catch-all mailbox. The only solution is to disable the catch-all mailbox. After that, you will receive only emails sent to existing addresses, and no more bounce messages.