A catch-all domain accepts every address, so a live SMTP check can't tell a real mailbox from a made-up one. Here is exactly what the HeroBounce MCP server returns in that case, how an agent should read it, and where the honest limits are.
Based on each vendor's public MCP documentation as of September 2026. Vendors change their tools, so check the linked pages for the current behavior.
| MCP server | How a catch-all shows up | Confidence score |
|---|---|---|
| ZeroBounce | Final status value catchall (“Domain accepts all emails”) | None documented in the README |
| Bouncer | Surfaced as a quality signal next to deliverable / risky / undeliverable / unknown | Not shown on the linked page |
| HeroBounce | status: risky with is_catch_all: true and a 0-1 confidence | Yes, on every result |
The response shape is the live MCP output. Confidence and provider values are taken from real production validations; addresses are anonymized.
{
"email": "alex.morgan@example-company.com",
"status": "risky",
"confidence": 0.77,
"is_valid": false,
"is_deliverable": true,
"provider": "google",
"is_catch_all": true,
"is_disposable": false,
"is_spam_trap": false,
"cached": false
}Catch-all domain, but the address fits what we know about the domain. The status staysrisky by design; the signal is the confidence.
{
"email": "sam.rivera@example-enterprise.com",
"status": "risky",
"confidence": 0.5,
"is_valid": false,
"is_deliverable": true,
"provider": "proofpoint",
"is_catch_all": true,
"is_disposable": false,
"is_spam_trap": false,
"cached": false
}Behind a secure email gateway such as Proofpoint, the mailbox genuinely can't be known from outside. We return an honest 0.50 instead of pretending.
Branch on confidence, not on status or is_deliverable. For catch-all addresses the status is risky and is_deliverable is true, so neither tells you which side of the line an address falls on.
if result.is_catch_all:
if result.confidence >= 0.70: send
elif result.confidence <= 0.30: skip
else: hold for reviewThe 0.70 and 0.30 cut-offs are a sensible default for cold outbound, not a law. Tighten or loosen them to match how much bounce risk your sender reputation can absorb.
Across all catch-all validations in the last 90 days (tens of thousands of addresses, all users):
A confident score is not a guarantee. We have not yet published a reproducible accuracy benchmark, and until we do, treat the score as a triage signal for which addresses to send, skip, or hold - not as verified deliverability.
Validate jane.doe@<a-domain-you-are-targeting>.com with HeroBounce. If the domain is catch-all, tell me the confidence score and whether it is safe to send at a 0.70 threshold.
The MCP server needs an API key, which is included with Pay As You Go (from $2.10) and every paid plan. Catch-all scoring depth varies by plan - see pricing. Free accounts can validate in the dashboard but not through the API or MCP.