The cPanel Default Address is usually described as a catch-all, but it is really the last local lookup in a fixed sequence. Mail hits that address only after the system has checked for a real mailbox and any matching forwarder, and it stops there if a global discard rule swallows the message first. Understanding that order explains most of the “my catch-all never fires” tickets you will ever see.
How cPanel resolves a recipient before the Default Address is consulted
When an SMTP session arrives, the mail server has to answer one question: where does this local recipient go? cPanel answers it by walking a precedence chain. First it checks whether the recipient matches an actual mailbox on the account. If it does, the message is delivered to that mailbox and the rest of the chain is irrelevant. Second, it checks forwarders, including domain-level forwarders that match an entire domain rather than a single address. Third, it falls through to the Default Address, the domain-level catch-all. Fourth, if the server is configured with a global discard rule for unrouted mail, that rule takes over and the message is dropped before or instead of the default address, depending on how the discard is scoped.
The important consequence is that the Default Address is not a fallback for “mail I did not expect.” It is a fallback for “mail that survived the mailbox lookup and the forwarder lookup.” Those are different sets. A message addressed to sales@example.com when a sales mailbox exists is not unrouted, so the catch-all never sees it. A message addressed to anything@example.com when a domain-level forwarder is in place is already claimed by that forwarder, so the catch-all never sees it either. Only mail that matches nothing else reaches the Default Address.
This ordering is why cPanel, which is used by Namecheap shared hosting and GoDaddy cPanel hosting alike, behaves consistently across hosts even though the panels look different. The precedence is a property of the mail stack, not the branding. If you move a domain between cPanel hosts, the mailbox-then-forwarder-then-default sequence travels with it.
Where domain-level forwarders and global discard rules override the catch-all
Domain-level forwarders are the single most common reason a catch-all appears broken. A forwarder that matches the whole domain (for example, forwarding every address at example.com to one Gmail inbox) is evaluated before the Default Address. Once it matches, the message is routed and the default address is skipped entirely. This is expected behavior, not a bug, and it is the exact precedence the panel documentation implies: forwarders win over the catch-all.
Global discard sits on the other side of the Default Address and outranks it for mail that would otherwise be unrouted. If the server has a discard rule for messages with no matching mailbox or forwarder, that rule can drop the message before it ever reaches the catch-all destination, or discard it at the point where the default address would have accepted it. The practical result is the same: a global discard will override both the catch-all and any forwarder that did not already claim the message. Where the discard is scoped to the server rather than the domain, it can quietly nullify a catch-all you thought was live.
That gives a clean precedence stack: mailbox first, forwarder second, Default Address third, global discard last. Each layer only sees what the previous layers left behind. When someone reports that their catch-all is “not working,” the fastest diagnosis is to ask which layer actually caught the message, because the catch-all only fires on the leftovers.
Reading a cPanel Default Address entry and its forward-to target
In cPanel, the Default Address lives under the Email section and is configured per domain. You point it at a specified mailbox, such as catchall@example.com, or at an external address. The panel also lets you set it to discard, which turns the catch-all into a black hole for unrouted mail. A forwarder is a separate object with its own target, and a system account is a real mailbox that the mail server treats as a normal local recipient. The distinction matters because a system account will always be found in the first lookup, while a forwarder is found in the second, and the Default Address only matters for what neither of those captured.
One more subtlety: the Default Address must be set on the domain whose MX records point at that cPanel server. If a domain’s MX record lookup returns a different mail provider, cPanel never sees the message, so the catch-all on the cPanel side is irrelevant no matter how it is configured. GoDaddy catch-all email is worth a closer look. The catch-all has to live where the MX records point, full stop. A domain split across two providers can have a perfectly good catch-all on the cPanel host that never fires because the MX records send all mail elsewhere.
The forward-to target also matters for deliverability. If the Default Address forwards to an external mailbox, the receiving provider may reject the forwarded copy as spam or as an unauthenticated relay. That is not a routing failure on cPanel’s side; the message was routed correctly and then rejected downstream. Checking the mail delivery log in cPanel tells you which of those two things happened.
Provider differences that change what “catch-all” actually means
Not every host implements catch-all the same way, and that changes the troubleshooting path. Namecheap offers catch-all via free email forwarding for domains that use its forwarding service, which is a different mechanism from a cPanel Default Address even though both are described as catch-all. GoDaddy provides a catch-all toggle in its own email management interface, and that toggle only applies to mailboxes on GoDaddy’s mail platform. Google Workspace requires its own catch-all rule, configured as a routing rule in the admin console rather than as a Default Address. cPanel’s Default Address applies specifically to domains hosted on a cPanel mail stack.
The upshot is that “set the catch-all” is not a portable instruction. On a cPanel host you set the Default Address. On Namecheap’s forwarding service you configure a catch-all forwarder. On GoDaddy’s mail platform you flip the catch-all toggle. On Google Workspace you build a routing rule. Each of these sits at a different layer of the same conceptual stack, and mixing them up produces the classic symptom of a catch-all that looks configured but never receives anything.
Hosts that run cPanel under their own brand, including Namecheap shared hosting and GoDaddy cPanel hosting, inherit the cPanel precedence order. Hosts that run their own mail platform, including Private Email and Professional Email, implement catch-all in their own panels and may apply a different order internally. If you are debugging across providers, confirm which mail platform is actually answering the MX record before you touch any catch-all setting.
The spam trade-off is the reason many admins avoid catch-alls in the first place. Spammers may cause large amounts of spam at the default address once a domain is known to accept all recipients, because dictionary attacks and address-guessing become worthwhile. A catch-all that forwards everything to a real mailbox is an efficient way to poison that mailbox. If you enable one, expect to filter aggressively, and consider a dedicated mailbox for the default address rather than your primary inbox.
Delivery to a pipe-to-a-program target is a separate path worth knowing about. cPanel supports piping mail to a script, and that target is evaluated as part of the forwarder layer, not the Default Address layer. A pipe that fails or exits non-zero can produce an SMTP rejection, which looks like a routing problem but is really a script problem. The catch-all never gets involved because the message was already claimed by the pipe.
For most domains, the sane configuration is a real mailbox for the addresses people actually use, forwarders for aliases, and either a discard or a filtered catch-all for the rest. If you want unrouted mail to be visible, point the Default Address at a monitored mailbox. If you want it gone, set the Default Address to discard or add a global discard rule. What you should not do is assume the catch-all catches everything, because the precedence order guarantees it only catches the leftovers.
Practical wrap-up: when a catch-all is not firing, walk the stack in order. Confirm the MX record lookup points at the host where the catch-all is configured. Check whether a mailbox already matches the recipient. Check whether a domain-level forwarder matches. Check whether the Default Address is set to a real destination or to discard. Check whether a server-level discard rule is swallowing unrouted mail. The first layer that matches is the one that handled the message, and everything after it is academic. Set the catch-all deliberately, document which layer owns which addresses, and the routing will stop surprising you.