A catch-all accepts anything at your domain: sales@, jhgfds@, everything. It is switched on so that no mail is ever lost, and it reliably produces two problems that are worse than the one it solves.

What it costs

  • Unlimited spam. Senders generate addresses at known domains. With a catch-all every one of them is a valid address, so all of it is accepted and delivered.
  • Typos become invisible. A customer writing to sales@ instead of sale@ gets no bounce and no reply. Without the catch-all they would have been told immediately.
  • Backscatter. Your server accepts a message for a nonexistent address, then cannot deliver it, and sends a bounce to a forged sender - which gets your server listed.

What to do instead

Create the addresses you actually use as aliases into one mailbox. Ten aliases cost nothing and every one of them is deliberate.

info@     -> info mailbox
sales@    -> info mailbox
support@  -> info mailbox
billing@  -> accounts mailbox
noreply@  -> rejected, deliberately

Reject unknown addresses properly

# postfix - reject at the SMTP conversation, do not accept and bounce later
smtpd_recipient_restrictions =
    reject_unauth_destination,
    reject_unlisted_recipient
Rejecting during the SMTP conversation is right. Accepting and then bouncing is what creates backscatter, and it is the difference between telling the sender no and sending a stranger a message they did not ask for.

If you genuinely need one

A short-lived catch-all after a migration, to find addresses nobody documented, is reasonable. Deliver it into a separate mailbox, read it for a fortnight, create the aliases you find, and turn it off.

If it is on now, look at the mailbox before switching it off - it will show you which addresses are genuinely in use, and that is the list to create as aliases.