A catch-all accepts mail sent to any address at your domain, whether that address exists or not. It sounds like protection against typos, and it is mostly a way of collecting spam.
Where the setting is
In cPanel, Default Address under Email. Two meaningful options: discard mail to unknown addresses, or forward it to a mailbox.
The second is the catch-all. cPanel's own wording recommends against it, which is unusual for a settings page and is worth taking seriously.
Why it goes wrong
Spam senders do not need a list of your addresses. They try common ones (info, sales, admin, john, mail) thousands of them, against every domain they know.
Without a catch-all, all of those are rejected at the door, cost you nothing and never reach a mailbox.
With one, every single attempt is accepted and delivered. The mailbox fills at a rate that has nothing to do with your actual correspondence, and the genuine message you set this up to catch is somewhere in it.
The volumes are not comparable. A business might receive a handful of mistyped addresses a year and a catch-all mailbox measured in thousands of messages a month.
The second cost: no bounce
This one is less obvious and often matters more.
When mail to a wrong address is rejected, the sender gets a bounce. They see they got it wrong, and they try again correctly.
With a catch-all, the message is accepted. The sender believes it arrived. If nobody reads the catch-all mailbox (and nobody reads a catch-all mailbox after the first month) the message is simply lost, and both parties think it was delivered.
A rejection is information. Accepting everything destroys it.
What to do instead
Create the addresses people actually mistype. If your address is michael@, add mike@ as a forwarder. Two minutes, permanent, and it catches the real cases.
Create the standard role addresses as forwarders to somebody: info@, sales@, support@, and abuse@ and postmaster@, which are expected to exist for a domain that sends mail.
Set the default to reject. Everything else bounces, which is correct behaviour.
Setting up email forwarders goes over the mechanics.
Discard is worse than reject
cPanel also offers discarding unknown mail silently.
Avoid it. Mail is accepted and deleted, so the sender is told it was delivered and nothing exists. Rejecting is honest and produces a bounce the sender can act on.
Silent discarding is how correspondence disappears with nobody able to explain it afterwards.
When a catch-all is genuinely right
Two cases.
Temporarily, during a migration. When moving from an old system and you are not certain every address was recreated, a catch-all for a fortnight catches what you missed. Read it, create the real addresses, then turn it off.
When you use a unique address per service deliberately: giving each company its own address to see who leaked it. That is a real practice and it requires a catch-all. It also requires accepting the spam volume, and works best with aggressive filtering in front.
If you already have one
Do not simply switch it off, or mail people have been sending to a slightly wrong address starts bouncing with no warning.
Read the mailbox first. The addresses receiving genuine mail are visible in what has arrived over the past months. Create those as real forwarders, then turn the catch-all off.
Expect the mailbox to be almost entirely rubbish. That is the point being made.
If the account is also short of space, this is frequently why, managing mailbox quotas and email disk usage deals with finding it, and configuring spam filters walks through what to do about the rest.
Measure what the address is actually receiving
The argument against this setting is quantitative, and the numbers are available on any account that has one.
du -sh ~/mail/example.com/catchall 2>/dev/null ls ~/mail/example.com/*/cur 2>/dev/null | wc -l exim -bp | wc -l
Read how much of the account's storage the address holds and how fast it grew. On a domain that has existed for a few years the figure is usually larger than anybody expected.
That storage counts against the same quota as everything else, so an unattended address can fill the account and stop the site writing, which is a website outage caused by a mail setting.
The addresses that get harvested
Accepting everything means the domain accepts mail for addresses that were never created, and that is exactly what bulk senders test for.
A domain with this enabled receives mail for every name anyone has ever guessed, and each accepted message confirms to the sender that the domain accepts anything. The volume grows rather than settling.
awk '{print $NF}' ~/mail/example.com/catchall/cur/* 2>/dev/null | head -5
grep -ciE 'catchall|catch-all' /var/log/exim_mainlog 2>/dev/null
The alternative is to create the handful of addresses that genuinely receive mail and let everything else be refused. A refusal is information for the sender; acceptance followed by silence is not.
Replace it with something that answers
The reason people enable this is usually a real one, which is not wanting to miss a message sent to a mistyped address.
Two arrangements cover that without accepting everything. Create the specific variations that people actually mistype, which is a short list on most domains. And configure the plausible departmental names that customers guess at.
ls ~/etc/example.com/ 2>/dev/null | head -20
Both leave the domain refusing anything else, which keeps the volume down and gives a sender a clear answer when they get an address wrong. Creating email accounts covers setting them up.
Check it again after any mail change
This setting is enabled during migrations and troubleshooting more often than deliberately, so it appears on accounts where nobody chose it. After moving a domain, changing provider or restoring an account, read the mail routing configuration again rather than assuming it carried over as it was. A restored account can arrive with a setting from whenever the backup was taken, which may be years old. Two minutes of checking prevents a mailbox quietly filling for months.