A catch-all accepts mail sent to any address at your domain. It sounds convenient.
WHY IT IS A PROBLEM
Spammers send to guessed addresses at every domain: info@, admin@, sales@, and thousands of random strings. A catch-all accepts all of it.
The volume is substantial and grows over time, because a domain that accepts everything is recorded as one that accepts everything.
IT ALSO CONSUMES
Disk space, since every spam message is delivered and stored Your attention, since real mail is buried in it Your reputation, if the mailbox fills and starts bouncing
WHAT TO DO INSTEAD
Create the addresses you actually use, and add forwarders for the handful of variations people genuinely mistype.
Set the default address to discard rather than accept, under cPanel > Default Address.
THE ONE LEGITIMATE USE
Temporarily, when taking over a domain and you do not yet know which addresses are in use. Review the traffic for a week, create the real addresses, then turn it off.
