We verified the primary domain of every company on the Fortune 500, and two questions drove the study: how many run a catch-all domain, and how many sit behind a secure email gateway? For the majority of America's largest companies, the answer is at least one, and often both. Nearly seven in ten Fortune 500 domains (69%) run a catch-all, sit behind a gateway, or both, while only 31% present the standard mailbox setup an ordinary verifier reads cleanly.
Those two configurations matter because of who sits behind them. Enterprise accounts are some of the highest-value targets in B2B, the logos every revenue team wants in its pipeline, yet their infrastructure is exactly what makes standard email verification less conclusive. A secure email gateway is an inbound filtering layer that answers the verification probe before the real mailbox ever does; a catch-all domain accepts mail for addresses that may not exist, so a server saying "accept" tells you nothing about the person you are trying to reach. The result is a list full of contacts you cannot confidently email, and a bounce rate you only discover after the message is already gone and damaged your sender reputation.
This is an Allegrow original data study, not a generic explainer. We resolved all 500 primary domains and tested them with roughly 4.9 million individual validations in late June 2026, so every figure below is first-party rather than an estimate. In this article, we break down how many Fortune 500 companies run catch-all domains, how many use secure email gateways, how the two overlap, which vendors and mailbox platforms dominate the enterprise stack, and what all of it means for teams selling into large organizations.
TL;DR: Allegrow verified the primary domain of every Fortune 500 company in late June 2026, roughly 4.9 million individual validations, as a full census rather than a sample. The headline: 69% (344 of 500) run a catch-all domain, sit behind a secure email gateway, or both, leaving only 31% (156) on the standard setup an ordinary verifier reads cleanly. Individually, 47% (235) are catch-all, 55% (276) are gateway-fronted, and 33% (167) are both, the hardest case. The catch-all figure is a conservative floor, since 53 inconclusive domains were counted as not catch-all. The stack underneath is uniform: Microsoft 365 on 82% of domains and Proofpoint fronting 80% of gateways, making Microsoft 365 behind Proofpoint the enterprise default. Both configurations exist for practical reasons, but the effect is identical: the server answers "accept" for addresses that may not exist, so SMTP-only checks return catch-all or unknown. For B2B teams, the easily verified enterprise domain is now the minority, and reaching these accounts needs verification that resolves the specific mailbox rather than reading a blanket acceptance.
Key findings from the Fortune 500 benchmark
Two challenges get asserted constantly in B2B, first, that enterprise contacts are hard to verify, and second, that many companies are behind a gateway now, but they are rarely measured. This study is the measurement. Across all 500 primary domains, tested in late June 2026, here is what the study found.
- 55% sit behind a secure email gateway (276 of 500)
- 47% run a catch-all domain (235 of 500)
- 33% have both a gateway and a catch-all (167 of 500)
- 69% carry at least one of the two (344 of 500)
- 31% run a standard setup with neither (156 of 500)
Read together, these numbers describe an enterprise email landscape that standard email verification was never built for. Only about a third of the Fortune 500 (31%) presents the clean, single-layer mailbox setup a conventional SMTP check can read with confidence. The other 69% add at least one obstacle that turns a normally simple question, “does this specific mailbox exist?”, into an unknown output.
The catch-all number is the one to sit with. Just under half the list (47%) accepts mail in a way that actively masks whether an address is real. Their server returns "accept" at send time regardless of whether the mailbox exists. This is exactly why the old habit of sending a test email and watching for a bounce proves nothing on these domains; the message is accepted either way, so silence tells you the domain is catch-all, not that your contact is real.
What percentage of Fortune 500 domains use a catch-all server?
235 of 500 Fortune 500 domains, or 47%, operate as catch-all. The denominator is every company on the list: we resolved all 500 primary domains, so this is not a rate drawn from a convenient subset. Just under half of the largest companies in America run domains that accept mail addressed to people who may not work there, or may not exist at all.
For a verification tool, that is the hardest possible starting point. When a catch-all domain returns an "accept" at the SMTP layer (the point in the email handshake where a server signals it will take the message), it is answering the same way for every address, so the accept carries no information about the specific mailbox you asked about. A conventional check reads that response and stops at "catch-all" or "unknown."
One transparency note. For 53 of the 500 domains, catch-all detection was inconclusive at the time of testing, and we classified those as not catch-all rather than assume the harder case. The 47% is therefore a floor, not an inflated estimate.
What percentage use secure email gateways?
276 of 500, or 55%, sit behind a secure email gateway. Therefore, more than half the Fortune 500 routes inbound mail through a filtering layer before it ever reaches the actual mailbox provider.
That layer changes what a verifier sees. When you probe an address on a gateway-fronted domain, the gateway answers first, not the Microsoft 365 or Google Workspace mailbox behind it. Many gateways are built to accept-then-scan, returning an "accept" for addresses they have not actually confirmed, which from the outside looks identical to catch-all behavior.
For a legacy verifier, that is a dead end. It never reaches the Microsoft 365 or Google Workspace mailbox that could actually answer, so on more than half the Fortune 500 it returns "catch-all" or "unknown" on the strength of the gateway alone, not because the contact is unreachable. The filtering layer in front is enough, on its own, to turn a resolvable mailbox into a guess.
How we analyzed Fortune 500 email infrastructure
Study at a glance
- Universe: all 500 companies on the Fortune 500, primary corporate domains
- Ranking source: Fortune
- Snapshot: late June 2026
- Evidence base: ~4.9 million individual email validations
- Method: full census, not a sample; each domain classified for catch-all behavior and secure email gateway use
- Publisher: Allegrow
- How to cite: Allegrow, "Fortune 500 Catch-All and Secure Email Gateway Study," June 2026, https://www.allegrow.co/knowledge-base/fortune-500-catch-all-gateway-email-study
We built this study to be reproducible and to hold up to scrutiny, so the method matters as much as the numbers. The universe is the Fortune 500, Fortune's ranking of the largest U.S. companies by revenue. For each company we took the primary corporate domain, resolved its live mail configuration, and verified addresses against it in late June 2026.
One point belongs up front, because it changes how the figures should be read. This is a census, not a sample. We tested all 500 companies rather than a representative subset, so there is no sampling margin of error to caveat: the percentages describe the entire Fortune 500 as configured on the test date.
The classifications rest on roughly 4.9 million individual validations across the 500 domains, a mean of about 9,900 per domain and a median of about 1,800. A domain's catch-all status therefore reflects observed behavior at volume, not a single lucky or unlucky probe.
One methodological choice made the whole study possible. An SMTP-only check, a verifier that reads only the accept-or-reject response a server gives during the SMTP handshake, sees nothing but that "accept" on these domains, and cannot tell whether a real mailbox sits behind it. So it does what legacy tools do, and guesses: it returns false positives, or hedged statuses like "catch-all" and "unknown." Resolving all 500 domains to a conclusive valid or invalid result took more than that handshake, and more than MX and syntax checks. It took Allegrow's proprietary, signal-based methodology, which reads multiple existence signals for each individual mailbox to separate a real inbox from a domain that simply accepts everything. That is the capability behind every figure in this study.
Two limits are worth stating plainly here, with the fuller note at the foot of the article. We classified the primary domain only, not every domain a company owns, and we counted visible, MX-fronted gateways, not every internal security control a company may run. And because enterprise mail configurations change, these figures are a point-in-time snapshot of late June 2026.
What counted as a catch-all domain?
A catch-all domain accepts mail for addresses whether or not the specific mailbox exists, so a server "accept" does not prove the person is real. In this study, we classified a domain as catch-all when it accepted mail at SMTP time in a validity-masking way: it either accepted everything, or accepted the message and bounced it afterward. Domains that cleanly rejected unknown addresses were not catch-all, and the 53 domains where this behavior was inconclusive were counted as not catch-all rather than assumed into the harder case.
That is the classification rule behind every catch-all figure in this piece, stated so the numbers can be checked against it. For the deeper mechanics of resolving these domains, see our catch-all email verification guide for B2B.
What counted as a secure email gateway?
A secure email gateway is an inbound filtering layer that sits in front of the mailbox provider and inspects or reroutes mail before it reaches the inbox. We identified gateways from each domain's live MX records, the mail servers a domain publishes to receive mail, and grouped them by vendor: Proofpoint, Mimecast, Cisco IronPort, Barracuda, and similar products. Whatever the brand, the category behaves the same way: it answers for the domain before the real mailbox, whether that mailbox is Microsoft 365, Google Workspace, or something else.
The scope is deliberately narrow, and worth repeating. We counted visible, MX-fronted gateways only. A company running an internal or API-based security layer that does not surface in its public MX records would not register here, so if anything the 55% understates how much of the Fortune 500 filters inbound mail before delivery.
What did the Fortune 500 data show?
With the definitions set, here is how the 500 domains actually distribute, and what the patterns mean for anyone emailing into these companies.
How do catch-all and gateway usage overlap?
The two obstacles are not independent, so the most useful view is the overlap. Sorting every domain into one of four cells, catch-all or not against gateway or not, the Fortune 500 splits like this.
Two-thirds of the list sits outside the clean "standard" cell. Only 156 companies (31%) run a domain with neither a catch-all nor a visible gateway, the configuration a conventional verifier reads without trouble. Every other cell adds friction.
The hardest cell is the top left: 167 companies (33%) run a catch-all behind a secure email gateway. A filtering layer answers first and a catch-all sits behind it, so a standard check meets two masking layers at once. In our snapshot, this is the default posture that appears in names you would recognize, Walmart, Costco, and Home Depot among them.
The catch-all-only cell (68 companies, 14%) is the pure-domain case: no gateway in front, but the domain still accepts mail for addresses that may not exist. Amazon was one example at the time of testing, accepting on a domain with no visible gateway. The gateway-only cell (109 companies, 22%) is the inverse: a filtering layer in front of a mailbox that would otherwise answer cleanly.
The takeaway is simple. The standard, easily verified enterprise domain is now the minority case.
What infrastructure sits underneath?
Underneath the catch-all and gateway behavior, the enterprise mail stack is strikingly uniform. Microsoft 365 is the mailbox platform for 412 of the 500 companies (82%), rising to roughly 85% once likely-Microsoft configurations are counted. Google Workspace runs just 17 (3%).
On the gateway side, the concentration is just as sharp. Of the 276 gateway-fronted domains, Proofpoint fronts 222 (80%), Mimecast 21 (8%), and everything else 33 (12%), most of that Cisco IronPort. Put the two together and one stack dominates corporate email: Microsoft 365 and Proofpoint.
That single configuration is the same one sitting in the hardest-to-verify cell above, and it is effectively the enterprise default. For B2B senders the uniformity cuts both ways. The terrain is at least predictable, but the most common enterprise setup is also the one that masks mailbox validity most effectively.
Why do large companies use catch-all or gateway-fronted infrastructure?
These configurations are not mistakes or signs of neglect. They are deliberate choices that make sense for a large organization, even though they happen to make email verification harder. Understanding the reasons explains why the numbers look the way they do.
Why might enterprise domains be set up as catch-all?
A domain can be set up as catch-all for several practical reasons, and most have nothing to do with sloppy administration.
Most of it are for operational purposes. Large organizations carry years of aliases, departmental addresses, acquired brands, and legacy routing, so accepting mail and sorting it internally is often simpler and safer than maintaining a perfect list of every valid recipient. Catch-all handling also captures honest typos rather than bouncing legitimate mail, and it gives mail administrators room to reroute addresses without breaking delivery during a migration or reorganization. Add a secure email gateway that accepts a message before it filters it, and broad acceptance becomes the path of least resistance rather than a deliberate choice.
Whatever the reason, the effect on verification is identical. When the server accepts mail for many addresses, a standard SMTP check cannot tell whether one specific mailbox is real.
Why do secure email gateways matter for verification?
A secure email gateway matters for verification because of where it sits: between the outside world and the real mailbox. When a verifier probes an address, the gateway answers first, on its own logic, before the Microsoft 365 or Google Workspace mailbox is ever consulted.
Many gateways are built to accept-then-scan: they take the message, then filter it for spam and malware afterward, which means they return an "accept" for addresses they have not actually confirmed. From the outside, that is indistinguishable from a catch-all, even when the mailbox underneath would cleanly reject an unknown address.
The practical implication is that appearances lie. A domain can look catch-all purely because of the layer in front of it, while specific mailboxes behind it remain perfectly resolvable with the right method.
What does this mean for B2B email verification?
The contacts most worth reaching are the ones standard verification handles worst. Fortune 500 accounts are some of the highest-value targets in B2B, yet 69% of them run infrastructure that pushes an ordinary verifier toward "unknown", "catch-all", or "risky". That is not a reason to avoid enterprise contacts. It is a reason to verify them differently.
How should teams handle catch-all-heavy enterprise lists?
Most verifiers only run basic syntax, MX & SMTP checks. They ask the server one question, does this address exist, and read the accept-or-reject reply. That works on the standard 31% and fails on the other 69%. On a catch-all or gateway-fronted domain the reply is always "accept", so the tool cannot tell a real mailbox from a fake one and returns catch-all, unknown, or risky.
For a prospecting team, that means a chunk of your best enterprise contacts come back unusable. Not because the people are unreachable, but because the tool could not tell.
Allegrow is built for this case. Instead of stopping at the “accept”, it tests whether the specific mailbox exists behind the catch-all or gateway with proprietary methods using a signal-based analysis, and returns a conclusive “valid” or “invalid” result on every contact. Where most legacy verifiers return "unknown", Allegrow returns an answer. This benchmark was only possible because of that, since you cannot resolve all 500 domains with a legacy tool.
And you can see the gap on your own data. Start a free trial, take up to 1,000 of the enterprise contacts your current tool wrote off as "catch-all" or "unknown", and see how many were reachable all along. It is the same method behind this study, pointed at your pipeline instead of the Fortune 500.
What mistakes should teams avoid when emailing enterprise contacts?
- Assuming catch-all means safe. An accept is not a confirmation; on at least 47% of the Fortune 500 it tells you nothing about the mailbox.
- Assuming catch-all means unusable. Many catch-all domains sit in front of real, reachable decision-makers who are resolvable with the right method.
- Mixing unresolved catch-all contacts into main campaigns. The incorrect catch-all addresses can quickly damage your reputation and the reach of everything else you send.
- Ignoring secure email gateways. A gateway can make a perfectly resolvable mailbox look catch-all, so gateway-fronted contacts need handling, not exclusion.
- Over-relying on generic verification tools for enterprise contacts. Standard email verifiers are the exact tools that fail on the 69% of these companies.
Conclusion
The Fortune 500 is not an edge case. Nearly 7 in 10 of America's largest companies (69%) run a catch-all, sit behind a secure email gateway, or both, and only 31% present the standard setup where it reliably replies to normal SMTP email verification.
For B2B teams, that reframes enterprise outreach. Catch-all domains and gateways are not rare obstacles to route around. They are the normal condition of selling into large organizations, and the easily verifiable 31% is now the exception.
The answer is not to avoid enterprise contacts; it is to use a verifier that’s able to resolve the “catch-all” and “unknown” results without guessing or test emails, and consequently protect your sender domain reputation once the list is clean. That is the layer Allegrow is built for: catch-all-heavy & gateway-fronted enterprise lists.
Start a 14-day free trial and run your own enterprise list through Allegrow. You will see exactly how many of the "unknown" and "catch-all" contacts your current verifier gave up on turn into clear valid or invalid results.
Frequently asked questions
How many Fortune 500 companies use catch-all email domains?
235 of 500 Fortune 500 companies (47%) run catch-all domains, based on Allegrow's late-June 2026 study of every primary corporate domain. The denominator is all 500. For 53 domains, catch-all detection was inconclusive and those were counted as not catch-all, so 47% is a conservative floor.
How many Fortune 500 companies use secure email gateways?
276 of 500 Fortune 500 companies (55%) sit behind a secure email gateway, per Allegrow's late-June 2026 study. The figure counts visible, MX-fronted gateways only, not internal security tools that never appear in a domain's public mail records, so real gateway use may be higher.
How many Fortune 500 companies use both a catch-all and a secure email gateway?
167 of 500 (33%) use both, the hardest combination for standard verification: a filtering layer in front and a catch-all behind. Roughly 69% (344 companies) have at least one of the two, leaving only 31% (156) on a standard setup an ordinary verifier reads cleanly.
Which secure email gateway do most large companies use?
Proofpoint dominates, fronting 80% of gateway-protected Fortune 500 domains (222 of 276). Mimecast is a distant second at 8% (21), and all other gateways make up the remaining 12% (33), most of that Cisco IronPort. Microsoft 365 behind Proofpoint is effectively the enterprise default.
What email platform do most Fortune 500 companies use?
Microsoft 365, on about 82% of Fortune 500 domains (roughly 85% including likely-Microsoft setups) and usually behind a gateway. Google Workspace is a small minority at about 3% (17 of 500). The Microsoft 365 plus Proofpoint stack is the most common enterprise email.
