How to Create a Catch-All Mailbox in Microsoft 365 / Exchange Online

Microsoft 365 is the one major business mail platform with no catch-all setting at all. There is no checkbox like Google Workspace’s routing rule or cPanel’s Default Address. What exists is a workaround that administrators have used for years: change how Exchange Online treats your domain, then add a mail flow rule that redirects unknown recipients to one mailbox.

It works, but it changes a default Microsoft chose for good reasons, so this guide explains both the steps and the trade-off. The Exchange Online settings were checked against Microsoft Learn on 2 November 2026. The catch-all pattern itself comes from administrator community answers, not from an official Microsoft catch-all guide, because no such guide exists. Test it in a non-production tenant or on a secondary domain first.

If you only need to understand what a catch-all is, start with what a catch-all email address means.

Why Microsoft 365 rejects unknown addresses

Every domain you add to Microsoft 365 is an accepted domain with one of two types:

• Authoritative. Mail is delivered only to addresses that exist for recipients in Microsoft 365. Mail for unknown recipients is rejected. This type turns on Directory-Based Edge Blocking (DBEB), which rejects messages for invalid recipients at the edge of the service, before anti-spam, anti-malware or mail flow rules even run.
• Internal relay (non-authoritative). Mail for known recipients is delivered; mail for unknown recipients is relayed onward, intended for your own mail server elsewhere.

New domains are normally authoritative. That is exactly why a catch-all is impossible by default: mail to anything-unknown@yourdomain.com is rejected before any rule could catch it.

What Microsoft warns about

Microsoft’s documentation on accepted domains says plainly that you should not select internal relay if all of the recipients for the domain are in Microsoft 365, and that internal relay expects a connector to your own on-premises mail server. The catch-all workaround uses internal relay without such a server. It works only because the mail flow rule redirects unknown-recipient mail before Exchange tries to relay it anywhere.

Two consequences follow:

1. You lose Directory-Based Edge Blocking. Messages to invalid recipients are no longer rejected at the perimeter, so more junk enters your tenant and has to be filtered instead of being refused outright.
2. A rule mistake has a wide blast radius. If the redirect rule is disabled, misconfigured or too narrow, unknown-recipient mail goes down the relay path and can bounce or loop.

If you just want to stop losing mail sent to people who left, a shared mailbox with aliases for their old addresses is often enough and keeps the domain authoritative. The catch-all is for when you genuinely want every address.

Step-by-step: the internal relay plus mail flow rule workaround

You need an Exchange administrator role in the tenant.

1. Create the catch-all mailbox

In the Exchange admin center, create a shared mailbox, for example catchall@yourdomain.com. A shared mailbox does not need its own licence for normal use, and several people can be given access to it.

2. Create a group that contains every real recipient

The rule needs a way to say “redirect, except when the recipient really exists”. The common approach is a dynamic distribution group whose membership includes all your mailbox users (and, if you use them, groups and shared mailboxes that should keep receiving their own mail). Exchange maintains the membership automatically as users are added.

3. Switch the domain to internal relay

1. In the Exchange admin center, go to Mail flow > Accepted domains.
2. Select the domain.
3. Under This accepted domain is, choose Internal relay.
4. Click Save.

In Exchange Online PowerShell the equivalent is:

Set-AcceptedDomain -Identity yourdomain.com -DomainType InternalRelay

4. Add the redirect rule

In the Exchange admin center, go to Mail flow > Rules and add a rule:

• Apply this rule if: the sender is located outside the organization.
• Do the following: redirect the message to the catch-all shared mailbox. Some administrators also prepend a subject tag such as [CATCH-ALL] so redirected mail is easy to spot.
• Except if: the recipient is a member of the dynamic distribution group from step 2.

Save the rule and make sure it is enabled.

5. Test, then watch message trace

Send a message from an outside account to an address that does not exist. It should arrive in the catch-all mailbox. Then send one to a real user and confirm it is not redirected.

If a real user’s mail lands in the catch-all, that user is not covered by the exception. A community answer on Microsoft Q&A describes exactly this problem and fixes it by adding an explicit exception for the affected address. Message trace in the Exchange admin center shows which rule touched a message.

Common problems

Real users’ mail is redirected. The exception group does not include them. Check the dynamic group’s filter, and add explicit exceptions for addresses that are not mailbox users, such as aliases or contacts you deliver to.

Unknown-recipient mail bounces instead of being caught. The rule did not run: it is disabled, its conditions are too narrow (for example a domain condition that never matches), or mail flow has not picked up the change yet. Check message trace.

Mail loops. If the catch-all mailbox itself forwards outside the tenant, forwarded mail can bounce back into the same rule. Keep the catch-all mailbox as a destination, not a relay.

Spam increases. Expected: without DBEB, guessed and random addresses are accepted and land in the catch-all. Point it at a mailbox you can filter aggressively.

When this is worth it, and when it is not

Worth it for a business domain that receives a modest amount of misaddressed mail you cannot afford to lose, with an administrator who will look after the rule.

Not worth it when the catch-all exists to feed software. SEO and account-creation tools such as GSA Search Engine Ranker, RankerX or XRumer generate addresses by the thousand and read a mailbox over POP3 or IMAP. Running that through your company tenant means turning off a perimeter protection on your business domain, routing registration traffic through your production mail flow, and tying your business domain’s reputation to mass sign-ups.

For that use, a separate catch-all domain is the cleaner design: it exists only to receive, its mailbox speaks POP3 and IMAP directly, and it can be replaced without touching Microsoft 365 at all. AllMail provides exactly that, with setup for GSA SER. For catch-all options on other platforms, see Google Workspace and cPanel, Namecheap and GoDaddy.

Questions

Does Microsoft 365 support catch-all email?

Not natively. There is no catch-all setting. The usual workaround switches the domain to internal relay and uses a mail flow rule to redirect unknown recipients to one mailbox.

Why do I need internal relay for a catch-all?

On an authoritative domain, Directory-Based Edge Blocking rejects mail for unknown recipients before mail flow rules run, so no rule can catch it.

Does Microsoft recommend this setup?

No. Microsoft’s documentation says internal relay should not be used when all of a domain’s recipients are in Microsoft 365. The workaround is widely used by administrators, but it is a workaround.

Do I need a licence for the catch-all mailbox?

A shared mailbox is the usual choice and normally does not need its own licence. Check your plan’s current limits for shared mailboxes.

Can I make the catch-all only for one domain?

The domain type is set per accepted domain, so you can switch only the domain you want and leave others authoritative. Keep the rule’s conditions aligned with that domain and test with message trace.

Is this a good setup for GSA SER or other link building tools?

It works technically but puts automation traffic through your business mail. A dedicated catch-all domain with POP3 and IMAP is the safer choice; see how GSA SER uses catch-all email.