We Probed 211 B2B Domains: 67% Are Catch-All, and No Email Format Covers 1 in 6 Companies

On this pagev

• Finding 1: two-thirds of B2B domains are catch-all
• Finding 2: there is no email format worth guessing
• Finding 3: one in seven plausible addresses gets refused
• The gateway problem nobody mentions
• What this dataset does not let us claim
• What to do with this if you run outbound
• Key takeaways

Every email finder on the market claims verified addresses. Almost none of them publish the number that decides whether verification is even possible: how many business domains accept mail for any address you send to. We pulled that number from our own pipeline, along with two others nobody prints, and they explain most of the bounces your "verified" lists produce.

Three findings, from 3,508 recorded SMTP probe outcomes (across 4,127 processed contacts and 211 fully resolved domains) between March 19 and July 5, 2026:

1. 66.8% of the domains are catch-all. The server says yes to everything, which makes "verified" pattern guesses against them unfalsifiable marketing.
2. The most common business email format covers 15.7% of companies. There is no dominant pattern to guess.
3. 13.3% of plausible addresses get refused outright when the server gives a definitive answer.

What this data is: first-party output from Kustiq's verification pipeline, the same one that runs on customer requests. We build a tool that competes with pattern-guessing email finders, so read the framing with that in mind. The numbers are reported as measured, sample sizes inline, and the section near the end covers what this dataset does not let us claim.

Finding 1: two-thirds of B2B domains are catch-all

Of the 211 domains our resolution pipeline has fully processed, 141 (66.8%) are classified catch-all: the receiving mail server accepts delivery for any local part, real or invented. 90 of those 141 also had no recoverable real address pattern anywhere on the public web.

Why this number matters more than any accuracy claim: against a catch-all domain, an SMTP-level check cannot distinguish a real mailbox from a fabricated one. The server accepts both. So when a pattern-guessing tool marks firstname.lastname@catchall-company.com as "verified", the claim is not wrong so much as untestable, and untestable is what you find out at send time, in your bounce dashboard, after your sender reputation already paid for it.

Two-thirds of the B2B domains we processed behave this way. Any email finder's headline accuracy number that does not disclose its catch-all handling is averaging away the majority case.

Finding 2: there is no email format worth guessing

Pattern-based email finders work off one assumption: companies use predictable address formats, so inferring first.last@ gets you most of the way. Here is the actual format distribution across the 70 domains in our cache with one identifiable real pattern:

The winner covers 15.7%. Guess the single most common business email format and you are right at fewer than 1 in 6 companies. The top three formats together cover 40%. The distribution has no head to bet on, it is nearly flat across ten shapes, and that is before the two-thirds of domains from Finding 1 where a pattern guess cannot be validated at all.

This is the quiet reason pattern-guess tools publish accuracy ranges like "60 to 80%": the method's ceiling is set by format entropy, and format entropy is high.

Finding 3: one in seven plausible addresses gets refused

Across the measurement window, 617 of our verification attempts reached a mail server and received a definitive verdict, accept or reject, no ambiguity. These were not random guesses: every one was an address our pipeline had already scored as the likely real address for a specific person, from public-web evidence.

The servers refused 82 of 617, a 13.3% rejection rate, with another 28 attempts hitting domains whose MX records no longer existed at probe time.

For calibration: Sparkle's 450-lead test measured a 13.3% verifier bounce on Apollo's database output. Our number says something adjacent but distinct: even researched, evidence-backed addresses get refused at that rate if you skip the handshake. This is the gap between "we found the address" and "the server will take mail for it", and it is why Kustiq refuses to return a contact that has not survived a live RCPT TO conversation. The free contact finder demo runs that exact check on every result.

The gateway problem nobody mentions

One more cut of the data, with the caveat that infrastructure noise inflates the gap (details in the next section). Confirmed-deliverable share of all processed contacts, by mail platform:

Domains behind security gateways like Mimecast are close to unverifiable by handshake in our data. That is by design; the gateway's job includes frustrating exactly this kind of probe. Any vendor claiming uniform verification across all mail platforms is describing a product that the email security industry works full-time to make impossible. The honest version, ours included, is: verify where the server cooperates, flag where it does not, and never label a gateway-shielded guess "verified".

What this dataset does not let us claim

The credibility of the three findings depends on saying this part out loud.

We cannot yet publish deliverability by industry. 82% of recorded probe outcomes (2,860 of 3,508) ended without a mailbox verdict: timeouts, plus windows where our own verification proxy was unavailable. Those failures cluster in time, which means slicing the survivors by industry would measure our infrastructure's uptime schedule, not industry mailbox behavior. We are fixing the single-proxy dependency and will publish the industry cut when a clean measurement window exists.

The domain sample is our funnel, not the internet. 211 domains skew toward the SMB and mid-market B2B verticals our customers prospect. The 66.8% catch-all rate describes that population; treat it as a benchmark for B2B outbound targets, not for all registered domains.

The format sample is small. 70 domains with a single confirmed pattern is enough to show the distribution is flat, not enough to rank position 4 against position 5. We publish it anyway because nobody else publishes theirs at any sample size, and we will refresh the table as the cache grows.

If a reader runs a comparable probe set and gets different numbers, send them: we will link the result here whether it flatters us or not, same policy as our pricing benchmark.

What to do with this if you run outbound

Assume two of your three target domains are catch-all. Which means list-cleaning services that "verify" via pattern plus MX check are structurally blind on the majority of your list. Ask any vendor for their catch-all handling before trusting their accuracy claim.

Stop paying for pattern confidence. A tool that guesses first.last@ is right about the format 1 time in 6, before the catch-all problem. If the price of a "verified" contact does not include a live handshake at delivery time, the verification happened in the marketing copy.

Treat gateway domains as a separate class. Mimecast and Proofpoint-shielded targets deserve different outreach economics: expect lower verifiability, budget for it, and weight other signals (LinkedIn activity, direct referral paths) more heavily there.

Frequently Asked Questions

What percentage of B2B domains are catch-all?

In Kustiq first-party data from 211 resolved B2B domains (July 2026), 66.8% are catch-all: the mail server accepts mail for any address at the domain. The sample skews toward SMB and mid-market B2B companies typical of outbound target lists. On a catch-all domain, an SMTP check cannot confirm whether a specific mailbox exists, so pattern-guessed addresses there cannot honestly be called verified.

What is the most common business email format?

first.last@ (jane.doe@company.com) is the most common single format, but it covers only 15.7% of the 70 domains with one identifiable pattern in Kustiq data. The top three formats combined cover about 40%. The distribution is nearly flat across ten formats, which is why guessing the most popular pattern gets you fewer than 1 in 6 companies.

Can you verify an email address on a catch-all domain?

Not with a standard SMTP handshake alone: the server accepts every address, real or invented, so the check returns yes regardless. Honest tools flag these contacts as catch-all rather than verified. Send-time behavior, reply history, or recovered public evidence can raise confidence, but a catch-all yes is not a verification.

Why do pattern-guessed emails bounce even when the format is right?

Because format is not existence. In Kustiq data, when mail servers gave a definitive verdict, they refused 13.3% of addresses that were already researched and judged plausible: the person left, the alias never existed, or the mailbox is shaped differently than the pattern suggests. The only way to know before sending is a live RCPT TO handshake with the receiving server, per address.

Key takeaways

• 66.8% of B2B domains in our cache are catch-all (n = 211). Verification claims that ignore catch-all handling are averaging away the majority case.
• No email format covers even 1 in 6 companies (first.last@ leads at 15.7%, n = 70). Pattern guessing has a structural ceiling no amount of data cleaning fixes.
• 13.3% of plausible, researched addresses get refused when the server answers definitively (n = 617). The handshake is not a nice-to-have, it is where the truth lives.
• Gateways make uniform verification impossible, and vendors who claim it anyway are describing their marketing, not their infrastructure.
• Sample sizes are printed next to every claim, and the industry-level cut we could not honestly publish yet is labeled as exactly that.