MailFerret · data study · 2026-10-13

56% of YC startup domains accept mail for any address

We looked at the mail setup of 499 randomly sampled active Y Combinator companies (from the public yc-oss list). For each website domain we read MX, SPF and DMARC records and asked the mail server, over SMTP, whether a random nonsense address exists. No email was sent.

Findings

82% run on Google Workspace (409), 5% on Microsoft 365 (23). 43 website domains (9%) receive no mail at all; those companies use a different email domain.
Of the 456 domains that receive mail, 254 (56%) are catch-all: the server accepted a random address. 177 (39%) rejected it, so individual mailboxes there can be verified. 25 (5%) refused to answer (Proofpoint, Cloudflare Email Routing, Amazon SES inbound and others block verification from unknown IPs).
On Google Workspace alone, 60% of domains are catch-all. On Microsoft 365, 35% (small sample of 23).
57% have no enforced DMARC policy (p=none 189, missing 95); 103 use p=reject and 112 p=quarantine.

What this means if you send cold email to startups

An SMTP verifier (ours included) can only confirm a mailbox when the server rejects addresses that don't exist. On a catch-all domain every address "passes", so a tool that marks [email protected] as "valid" there is telling you nothing. On YC-style startups that's more than half of all domains. For those, the best you can do is the right pattern (first name only is common at small startups, first.last at larger ones) and a low send volume until you see replies or bounces.

That's why MailFerret reports catch-all explicitly and doesn't charge for catch-all guesses: POST /find costs $0.01 only when the server confirms the mailbox.

SaaS tools visible in SPF records

SPF records list who may send mail for a domain, which leaks part of the tool stack. Share of the 499 companies whose SPF includes each sender:

Tool	Companies	Share
HubSpot	51	10%
Amazon SES	41	8%
Mailgun	32	6%
SendGrid	25	5%
Zendesk	21	4%
Mailchimp/Mandrill	17	3%
Zoho	11	2%
Salesforce	8	2%
Intercom	5	1%
Postmark	4	1%
Customer.io	3	1%
Resend	2	0%
Brevo	2	0%

SPF only shows tools that send mail as the company's domain, so these are lower bounds.

Method and limits

Sample: 499 companies drawn at random (seed 42) from the active companies with a website in yc-oss/api, all batches. Website domain used as the email domain.
Catch-all test: one SMTP session per domain from a single IP, RCPT TO a random 18-character local part; 2xx = catch-all, 5xx "user unknown" = not catch-all, anything else = inconclusive. A server can treat different IPs differently.
Aggregates only. We do not publish per-company results. Raw script: study/run.mjs, analysis study/analyze.py.

Check any domain yourself: MailFerret, 5 free lookups a day, or POST /domain ($0.005) from an agent.