Skip to content
Sign inGet started
Help · MoreCatch-all email on Cloudflare: set it up, and when not to
Start here

Catch-all email on Cloudflare: set it up, and when not to

How Cloudflare Email Routing's catch-all rule works, how to switch it on, what it can do with the mail, and how to keep it from filling up with spam.

On this page · 6 sections

What the catch-all rule does

Email Routing matches each incoming message against your routing rules, one per address. Mail that matches no rule falls through to the catch-all. [1][2] With it switched on, mail to any address on the domain reaches you, misspellings included: hello@, helo@, shop-2026@ or anything a sender makes up. [1]

That is useful for typos, and for giving each website its own address when you sign up (airline@example.com, bank@example.com) without creating each one first. When one of them starts getting spam, you know who leaked it.

Switching it on

  1. In the Cloudflare dashboard, open your domain, then Compute → Email Service → Email Routing → Routing Rules. [1]
  2. Turn on Catch-all rule so it shows as Active. [1]
  3. Choose an action from Action and press Save. [1]
Send to an email
Forwarded to one destination address. The address must be verified first. [1]
Send to a Worker
Handed to your own Worker code, which can store it, forward it to several places or refuse it. [1][3]
Drop
Deleted without being delivered. [1]

Limits to know

  • A forward goes to one destination. To send one address's mail to several people, use a Worker that forwards once per destination, each of them verified. [3]
  • Up to 200 routing rules per domain and 200 destination addresses per account. [3]
  • Incoming messages over 25 MiB are rejected. [3]
  • If two rules have the same pattern, only the first one in the dashboard list handles the mail. [1]

When a catch-all is a bad idea

A catch-all accepts mail for every address anyone guesses. Spammers send to common names (info@, admin@, sales@) and to made-up ones, and with a catch-all all of it is delivered.

  • Set the action to Drop and create a rule for each address you use. Mail to anything else is discarded.
  • Use plus addressing for per-site addresses instead, and leave the catch-all off.
  • Send it to a Worker that keeps only the addresses you want and refuses the rest, so the sender gets a bounce rather than silence. That is what Ayoh does, below.

How Ayoh uses the catch-all

When you connect a domain, Ayoh points the domain's Cloudflare catch-all at its own Worker, in your account. Every message for the domain reaches Ayoh, and Ayoh decides where it goes, in this order:

  1. An address you created, spelled exactly.
  2. An alias of one of your addresses.
  3. Plus addressing: sales+q3@ goes to sales@, or to the address sales@ is an alias of.
  4. The domain's catch-all address in Ayoh, if you ticked catch-all on one (Settings → Addresses). A domain has at most one.

Mail that matches none of them is refused with 550 No such mailbox, so the sender gets a bounce and spam to made-up names never reaches your inbox. You get a catch-all only if you ask for one, and you can switch it on or off for one address at any time.

Sources

Read October 29, 2026.

PreviousDMARC record generator: build the record, step by stepNextCloudflare Email Routing not working? What to check