Every catch-all migration I have watched go wrong failed at the same moment: someone pointed the MX record at the new provider before the new catch-all rule existed. Mail for a thousand invented addresses hit a server that had no idea what to do with them, and the sender got a 550. That bounce is permanent. The sender’s server does not retry, and you cannot recover the messages. The fix is sequence, not speed. Verify the destination, create the rule, lower the TTL, then switch MX, then leave the old provider running for a week as a safety net.

Verify the destination before you touch any DNS

The first job is proving that the inbox you plan to forward into actually accepts mail and that you control it. If the destination is a free Gmail account, send a test message from an outside address and confirm it lands in the inbox, not in Spam or Promotions. Check the spam and promotions folders by hand, because a catch-all that forwards into a folder nobody reads is worse than a bounce: it fails silently. For a domain catch-all routing into a verified Gmail address, the verification step usually happens at the router, not at Gmail. Cloudflare Email Routing, for example, sends a confirmation link to the destination address and will not forward a single message until you click it.

Understand what a free Gmail account can and cannot do here. Free Gmail cannot be configured as a catch-all on its own. There is no wildcard email address setting inside a personal Gmail account, and no amount of label trickery changes that. What free Gmail does offer is plus addressing, where mail sent to [email protected] delivers mail to the base Gmail address. That is useful for filtering and for handing out disposable email addresses, but it is not a catch-all in the routing sense. Plus addressing also exposes the real Gmail address in every header, so anyone who receives a message from you can strip the tag and reach you directly. Gmail ignores periods in gmail.com usernames, which means [email protected] and [email protected] are the same mailbox, a detail worth knowing when you audit which address variants already reach you.

Domain catch-all forwarding requires ownership of a domain, full stop. If you do not have one, the migration you are planning is really an alias cleanup, and you should say so before you start moving records. If you do have a domain, decide now whether the destination is a free Gmail account fed by a forwarder, or a Google Workspace mailbox. Google Workspace supports catch-all addresses natively through the admin console, so the rule lives on the same server that stores the mail. That removes one hop and one failure point. Weigh the trade-off honestly: Workspace costs money per seat, while a forwarder plus free Gmail costs nothing but adds a routing layer you have to monitor.

Create the rule and prove it works while the old MX is still live

With the destination confirmed, build the catch-all rule on the new side and leave the old provider untouched. On Cloudflare Email Routing, the catch-all is a single toggle plus a destination, and catch-all mail forwards to a verified Gmail address once the toggle is on. On cPanel, the equivalent lives under the default address setting for catch-all forwarding, where you point unmatched recipients at a mailbox or an external address. If you are moving to Google Workspace, create the catch-all in the admin console and add a test recipient. In every case the rule must exist and be enabled before any MX change, because the rule is what catches the long tail of addresses you forgot you ever published.

Now prove the rule works without moving production traffic. Send test messages to invented addresses on your domain, at least five of them, including one with a plus tag and one with a period in the local part. Confirm each one arrives at the destination. catch-all with a free Gmail account is worth a closer look. Check the headers on one message to see the routing path, because a forwarder that rewrites the envelope can break SPF alignment and push your mail into spam at the far end. This is the stage where email filtering rules on the destination matter too. If your Gmail account has a filter that archives anything from your own domain, your catch-all test will pass in the logs and fail in the inbox.

Lower the MX record TTL to 300 seconds about 24 hours before the switch. This is the step most people skip, and it is the reason a “quick” migration drags on for two days. A TTL of 3600 or 86400 means resolvers around the internet keep handing out the old MX long after you edit it, so some senders reach the old server and some reach the new one. A short TTL shrinks that overlap to minutes. Do not lower it at the same moment you change the record; give the old TTL one full cycle to expire first.

Switch MX, watch the logs, and keep the old provider a week

Change the MX records to the new provider’s hosts, delete or deprioritize the old ones, and then sit and watch. The first hour tells you almost everything. Check the new provider’s routing log for accepted messages, check for rejects, and send a fresh test from an external account you have not used before, since cached DNS on your own machine will lie to you. If the new catch-all rule is live and verified, the invented addresses keep flowing. If it is not, you will see the bounces start, and the only remedy is to restore the old MX immediately and accept that some mail in the gap is gone.

Keep the old provider active for a full week. Do not cancel the old plan, delete the old cPanel default address, or remove the old forwarder on day one. Mail servers retry for up to several days, and a handful of senders will still be resolving the old MX from cache well after your TTL change propagates. During that week, compare counts: messages accepted by the new route versus messages still arriving at the old one. A gap usually points to a rule you missed, such as a subdomain MX or a hardcoded address in a CRM. This overlap window is also when you migrate any POP3 fetch jobs. Gmail no longer fetches mail over POP in 2026, so if your old setup relied on pulling from a legacy mailbox, that job has to be rebuilt as forwarding or abandoned.

Run the migration in that order every time: verify, create the rule, drop the TTL a day early, switch MX, and hold the old provider for seven days. The sequence costs you about 30 hours of calendar time and almost no risk. Reversing it costs you mail you cannot get back. AllMail takes the same approach when it consolidates catch-all addresses into a single searchable inbox, because routing rules that exist before the traffic arrives are the only kind that never bounce.