How to Set Up a Catch-All Address in Zoho Mail (and Whether To)

A catch-all address in Zoho Mail routes any email sent to your domain — including addresses you never created — into one mailbox instead of bouncing it. Setting it up takes about five minutes in the admin console. Deciding whether you should is the harder part, because the same setting that rescues a mistyped address also opens the door to every spammer who guesses one.

This post covers the Zoho-specific steps. If you want the general case for and against catch-alls across providers, that's covered in the cPanel catch-all risk post linked below — this one stays inside Zoho Mail's admin console.

Before you start#

You need Super Administrator or Domain Administrator access in the Zoho Mail Admin Console — a regular mailbox user can't set this. You also need at least one existing mailbox on the domain to act as the catch-all destination; Zoho doesn't create a new one for this.

Confirm your domain is already verified in Zoho Mail (Domains section shows a green checkmark). An unverified domain won't let you touch routing settings at all.

• Super Admin or Domain Admin role
• One existing mailbox to receive the catch-all mail
• Domain already verified in Zoho Mail

Steps to set up a catch-all address in Zoho Mail#

1. 1

   Open the Mail Admin Console

   Sign in at mailadmin.zoho.com with a Super Admin or Domain Admin account.

2. 2

   Go to Domains

   In the left sidebar, click Domains, then select the domain you want to configure.

3. 3

   Find the Catch-All Address setting

   Under the domain's configuration tabs, open Catch-All Address (Zoho also lists this as the domain's default or unknown-recipient address, depending on console version).

4. 4

   Choose the receiving mailbox

   Select an existing user mailbox from the dropdown. This mailbox will now receive every message sent to an address on your domain that doesn't otherwise exist.

5. 5

   Save and test

   Save the change, then send a test message to a made-up address on your domain (something like [email protected]) and confirm it lands in the chosen mailbox within a few minutes.

Platform differences: Zoho vs. other providers#

Zoho mail catch-all spam problem: what to expect#

The moment a catch-all is live, every address a spammer can guess for your domain is a working address. Dictionary attacks — automated attempts at info@, sales@, admin@, and thousands of common first-name combinations — all land in your one mailbox instead of bouncing with a 550 error.

This is the mechanism, not a maybe. Zoho's own admin documentation notes that a catch-all should be monitored closely because it accepts mail for any local part, valid or not. If your domain gets any outbound spoofing or scraping attention, catch-all volume rises fast and the good mail gets buried in it.

Is a catch-all email address a bad idea for your domain?#

For most small teams, yes — a handful of specific aliases (info@, support@, billing@) forwarded to the right inboxes covers the legitimate use case without the open-ended exposure. A catch-all earns its keep in two narrower situations: you're actively migrating addresses and don't yet know every alias in use, or you run a domain (agency, personal brand) where people invent addresses on the fly and you'd rather see everything than miss something.

If neither applies, set up the specific aliases you actually need under Users → Aliases in the admin console and skip the catch-all entirely. It's less setup than a catch-all plus the spam filtering you'll eventually add to cope with it.

Catch-all vs. alias in Zoho: the practical difference#

An alias in Zoho Mail is a specific extra address (like [email protected]) that delivers to one mailbox — nothing else. A catch-all is the fallback for everything that isn't an alias, a real mailbox, or a group address on the domain. They're not competing settings; a catch-all only fires after Zoho checks whether the address matches something real first.

That means the domain's default routing behavior when a catch-all is off is a clean bounce (550 5.1.1, no such user) — which is itself a useful signal to senders that they got the address wrong.

What to do when it doesn't work#

If test mail to a made-up address isn't reaching the catch-all mailbox, check these in order.

A faster way to handle unknown-recipient mail#

A catch-all solves routing, not triage — once the mail lands, someone still has to work out what's a real inquiry buried in the noise. AI Emaily's spam and cold-email filtering sits on top of any mailbox, Zoho included, and separates dictionary-attack junk from the occasional legitimate message that landed on a typo'd address, so a catch-all mailbox stops being a place things go to be lost.

We build AI Emaily. It connects to Zoho Mail over IMAP in a few minutes and doesn't require replacing your existing setup — it triages what's already arriving.