Most local citation campaigns fall apart at the same place: the verification email that never arrives, or arrives and gets buried under forty others. A catch-all email fixes the volume problem by giving every listing its own address on one domain, all landing in a single catch-all inbox. What it does not fix is discipline. I have watched people burn a perfectly good catch-all email domain on a hundred directory submissions with no alias map, no filter rules, and no test of whether the host actually accepts mail from the directories they care about. The listings go live half-verified, the client notices a missing phone number three weeks later, and the cleanup costs more than the original campaign.

The checklist below is the one I run before verifying anything, whether it is a fresh batch of citations or a rebuild of an old profile set. It covers domain pre-flight checks, alias-to-location mapping, Thunderbird filter routing, a hard test of the catch-all host’s inbound spam filter, and the trade-offs between anonymous catch-all email domains and the no KYC email services that advertise them. Each step is short. Skipping any one of them tends to surface as a failed verification at the worst possible moment, usually after a directory has already locked the submission.

The order matters. Domain checks come first because a burned domain invalidates everything downstream. Mapping comes next so aliases do not collide across locations. Filter routing and spam-filter testing come after that, and the provider choice runs through all of it, since a host that silently drops directory mail is useless no matter how clean your spreadsheet is. Work the list top to bottom, and you will spend your time on listings instead of on recovery.

Why a Catch-All Email Is the Backbone of Local Citation Campaigns

A catch-all email address is the one inbox that accepts mail for every alias on a domain, whether or not that mailbox exists. Submit a citation to a local directory with listing+joesplumbing@yourdomain.com and the verification link lands in the same place as listing+dentist-main-st@yourdomain.com. No mailbox setup, no provisioning delay, no password to track. For anyone running local citations at volume, that single behavior removes most of the administrative friction that makes directory work painful.

Run the numbers on a typical local campaign. A mid-size citation push covers 40 to 80 directories per location, and a multi-location client with four branches can easily mean 200 to 300 submissions. Each directory sends a confirmation email, and many send a second one when the listing goes live or when someone edits it. Per-listing mailboxes at that scale means hundreds of accounts to create, document, and monitor. A catch-all inbox turns all of it into one stream you can filter, search, and archive.

The alternative approaches all break down somewhere:

• One shared mailbox per client. Works until two clients get submitted to the same directory and you cannot tell which verification belongs to which listing.
• Plus-addressing on a single Gmail account. Fine for ten listings, unusable at a hundred because Google throttles and sometimes silently drops mail to aliases it considers unusual.
• Disposable inboxes. Verification links expire, the inbox dies, and when a directory asks you to re-confirm six months later the mail is gone.
• Your real business address. Every directory you submit to now has your primary email, and so does every email scraper that harvests directory pages.

A catch-all inbox also solves the notification problem, which citation builders underestimate. Directories send NAP mismatch warnings, listing suspension notices, and “your submission needs review” messages long after the initial verification. If those go to an address nobody monitors, the citation quietly dies and you never know. One catch-all inbox with a forwarding rule to your project management tool keeps every notification visible.

The same logic applies when citations feed a broader link pipeline. People running GSA SER, RankerX, or Xrumer alongside local SEO work already know that catch-all email for GSA SER style workflows live or die on inbox access. A catch-all email domain gives you POP3 and IMAP access to every alias, so a registration bot or a manual operator can pull the confirmation code without touching a control panel. Services like AllMail provide catch-all email addresses built for exactly this: one domain, unlimited aliases, POP3 and IMAP access, and no per-mailbox setup. AllMail supports GSA SER, RankerX, and Xrumer, accepts crypto payments, and requires zero KYC, which matters when you are spinning up citation domains at scale.

Two trade-offs to keep in mind before you commit. First, a catch-all domain concentrates risk: if the domain lands on a blacklist, every alias on it stops receiving verification mail at once. Second, some directories reject free-mail and disposable domains outright, so the domain you choose has to look like a real business domain, not a throwaway. Both problems are manageable, and the next sections walk through the checks that keep them from wrecking a campaign. The point here is simpler: at citation volume, a catch-all inbox is not a convenience, it is the only setup that scales.

Pre-Flight Domain Checks: Avoiding DBL-Listed and Burned Catch-All Domains

Run the domain through a DBL and DNSBL check first

Before a single citation form gets filled, put the catch-all domain through a domain blocklist lookup. Spamhaus DBL is the one that matters most for citation work: it flags domains by reputation, not just by IP, so a burned domain can be listed even when the mail server behind it is clean. Run the same domain against a couple of secondary DNSBLs to catch regional or niche listings. If anything comes back positive, stop and pick another domain. A DBL hit on a citation domain means directory confirmation mail lands in spam or gets rejected outright, and you will not find out until half your listings sit unverified.

While you are in the lookup tools, check the domain’s age and registration history. A catch-all domain registered two weeks ago with no mail flow behind it looks exactly like what it is: a fresh throwaway. Warm it with a few days of ordinary traffic and a handful of test messages before you point citation work at it. If the provider offers blacklist monitoring, switch it on so a later listing gets flagged before it costs you a batch of verifications.

Check for prior citation and spam history

A domain can be clean on every blocklist and still be burned. Search the exact domain in quotes across Google and Bing. Look for old directory listings still pointing at it, cached spam pages, or forum posts naming it. Ten minutes of searching saves a week of failed verifications.

Next, check whether the domain has been used as a shared domain for bulk submissions. Grab a sample of the domain’s historical subdomains from certificate transparency logs (crt.sh is free). A wildcard-heavy history with dozens of random subdomains usually means the domain was used for automated submission runs, possibly with GSA SER or Xrumer, and its reputation is already shredded. A domain with two or three clean subdomains and nothing else is a much safer bet.

Also check what else lives on the same registrable domain. If you are using a subdomain of a larger shared domain, the parent’s reputation drags yours down with it. A fresh subdomain on a domain that has been spraying links for years gives you none of the isolation you want from a catch-all setup.

Finally, confirm the mail side actually works before you trust it. Send a test message from a throwaway address to a random alias on the catch-all (anything@yourdomain.tld) and confirm it arrives in the catch-all inbox. Then send one from a directory-style sender, like a noreply address on a shared hosting IP, and confirm that arrives too. If the second message vanishes, the host’s inbound filter is dropping it and you will lose verification mail later. A domain that passes the blocklist check, the history check, and both test messages is ready for citation submissions. Anything less and you are gambling a whole campaign on a domain you have not inspected.

Mapping Aliases to Location IDs Before You Submit a Single Citation

The mistake that costs the most time in a citation campaign is not a rejected listing. It is a verification email that lands in the catch-all inbox with no way to tell which of your 40 locations it belongs to. Once that happens you are left guessing, re-submitting, and sometimes creating duplicate listings that take weeks to clean up. The fix is boring and takes about an hour: build the alias-to-location-ID map before the first submission leaves your browser.

Build the Map Before the First Submission

Open a spreadsheet with one row per location and these columns: location ID, business name as registered, street address, city, state, ZIP, phone, target alias, directory name, submission date, verification status, and notes. The location ID is the anchor. Use whatever your internal system already uses, whether that is a numeric ID, a store code like ATL-014, or a GBP place ID. Do not invent a new ID scheme mid-campaign, because the directories you already submitted to will reference the old one.

For the alias, pick a naming convention and write it down in a frozen header cell so nobody edits it later. A pattern that survives contact with real campaigns is loc-{locationid}-{directoryslug}@{catchalldomain}, for example loc-atl014-gmb@yourcatchalldomain.com or loc-atl014-yelp@yourcatchalldomain.com. The location ID sits before the directory slug so you can sort the inbox by alias and get every location’s mail grouped together. If you prefer directory first, that works too, but be consistent across all rows.

Collision risk is real and it is usually self-inflicted. Three patterns cause most of it:

• Alias reuse across locations. Reusing info@ or contact@ for two addresses in the same metro means the verification link for location A can confirm location B if you click the wrong one. Never share an alias between two rows.
• Case and separator drift. loc-atl014 and Loc-ATL-014 are different aliases on most mail servers. Pick lowercase and one separator style and enforce it with a data validation rule in the sheet.
• Directory slug mismatch. Yelp, YP, and Yelp for Business are not the same string. Keep a fixed list of directory slugs in a second tab and reference it, so a typo cannot create an orphan alias that nobody is watching.

Before you submit anything, do a dry run. Send a test message to every alias in the sheet from an external account, then confirm each one arrives and that your filter rules (covered in the next section) file it under the right location folder. Any alias that bounces or lands in the wrong folder gets fixed now, not after 200 submissions.

One more habit that pays off: log the exact alias you typed into each directory form in the directory column of the row. Directory forms sometimes silently lowercase, truncate, or strip characters from the email field. https://allmail.one/ offers additional context worth reviewing. When a verification email shows up three days later addressed to something slightly different from what you planned, the sheet tells you instantly which location and which directory it came from. That single column turns a 30-minute forensic exercise into a five-second lookup.

Routing Verification Mail: Thunderbird Filters for Per-Location Inboxes

Thunderbird is the workhorse here because its filter engine runs on the local profile, matches on any header, and does not care how many aliases land in one catch-all inbox. The setup that survives dozens of locations is boring on purpose: one folder per location ID, filters that key on the alias in the To or Cc header, and a fallback rule that quarantines anything unmatched so nothing disappears into the inbox.

Start with the folder tree. Create a top-level folder named after the campaign, then subfolders named exactly like your alias-to-location-ID map, for example LOC-1042, LOC-1043, and so on. Keep a separate Verification folder inside each one for the actual confirmation links and a Notices folder for directory newsletters, listing approvals, and renewal reminders. If you run several catch-all email domains, prefix the top-level folder with the domain so a LOC-1042 in domain A never gets confused with the same ID in domain B.

Now the filters. In Thunderbird, open Tools > Message Filters, pick the catch-all account, and create one filter per location. Match on “To” or “Cc” contains the alias (for example loc-1042@yourdomain.tld), then set the action to “Move message to” the matching folder. Do not use “From” as the primary condition: directory platforms send verification from shared senders like no-reply@directory.tld, and the same sender will mail twenty of your locations. The alias is the only reliable discriminator.

Order matters. Thunderbird runs filters top to bottom and stops at the first match only if you tick “Do not run other filters on this message.” Leave that box unticked for the per-location rules so a second pass can apply tagging, but put a catch-all quarantine filter at the very bottom that moves any message not matched above into a Review folder. That bottom filter is your early warning system: when a directory starts sending to a slightly different alias format, the mail piles up in Review instead of vanishing into a busy inbox.

Two practical details save hours. First, filters in Thunderbird apply to incoming mail only, so run them manually against existing messages with Tools > Run Filters on Folder after you build the set, otherwise the verification mail that arrived during setup sits unfiled. Second, the match is case-insensitive and substring-based, so an alias like loc-104 would also catch loc-1042. Use a trailing delimiter in the condition, such as loc-1042@, to prevent that collision, or pad your IDs to a fixed length.

For directories that send the confirmation link in a separate message minutes after the signup, add a second filter per location that matches “From” contains the directory domain and “To” contains the alias, and tags it with a color label. That gives you a visual cue in the location folder that the link has landed. When a verification email never shows up, check the Review folder before you blame the directory, then check the catch-all host’s spam log. If the host is silently dropping mail from shared directory IPs, no filter in Thunderbird will help, which is why the inbound spam test in the next step comes before any bulk submission run.

Back up the profile once the filters are proven. The msgFilterRules.dat file inside each account folder holds every rule, and copying it to a second machine lets a teammate work the same catch-all inbox without rebuilding fifty filters by hand.

The Silent Drop: Testing Inbound Spam Filters on the Catch-All Host

The most expensive failure in a citation campaign is not a rejected listing. It is the verification email that never arrives and never bounces. You sit there refreshing the catch-all inbox, the directory says “email sent,” and nothing shows up. No error, no delay notice, no trace. The message was accepted by the receiving host and dropped by a spam rule somewhere between the SMTP handshake and your inbox folder.

Local directories are prime candidates for this. A lot of them run on shared hosting or a bulk mail service with a dedicated IP pool that has been recycling the same addresses for a decade. One bad sender on that pool gets the whole subnet listed in a DNSBL, and your catch-all host, doing its job, quietly files the verification mail into quarantine or deletes it at the gateway. The directory thinks it delivered. Your host thinks it blocked spam. You get nothing.

The fix is to test the specific directory’s verification mail against the specific host’s inbound filter before you submit a single listing. Not after. Before. Here is the procedure that has saved more campaigns than any other single step.

1. Capture a real verification email. Register a throwaway listing on the target directory using a mailbox you control on a different provider, then open the raw source (Ctrl+U in most email clients) and save the full message with headers as a .eml file. Do not reconstruct it. The headers carry the sender IP, the return-path domain, the SPF result, and the exact subject line, and all of those matter to the filter.
2. Replay it to the catch-all host. Send the saved .eml to an alias on your catch-all domain using a tool that preserves the original headers, such as swaks with –data or a small Python smtplib script. If you just forward the message through Gmail, Gmail rewrites the headers and you are testing nothing.
3. Watch the logs, not just the inbox. POP3 and IMAP access tells you whether the message landed, but not why it did not. Check the host’s mail log or spam quarantine interface for the message ID. Look for the SMTP response code, the SpamAssassin or Rspamd score, and any DNSBL hit on the connecting IP. A score of 5.0 to 6.0 with a fresh DNSBL listing is the classic silent drop pattern.
4. Repeat from three sender IPs. Directories rotate their sending infrastructure. A message that passes from one IP can fail from another on the same pool. Three tests over 24 hours gives you a realistic picture.
5. Whitelist the sender before submitting. Once you know the return-path domain and sending IPs, add them to the catch-all host’s allowlist or a filter rule that bypasses spam scoring for that sender. This is the step most people skip, and it is the one that actually prevents the drop.

Two details bite people who skip the header inspection. First, many directories send verification from a subdomain of their main domain, like mail.directoryname.com, and the subdomain may have no SPF record at all. Second, some send from a shared domain used by hundreds of clients, which means the domain reputation is whatever the worst client made it. If you see either pattern, allowlist by IP as well as by domain, because the return-path will change.

Run this test once per directory family, not once per listing. Twenty citations on the same platform will almost always share a sender. Keep a small log of directory name, return-path domain, sending IP, spam score, and allowlist status. When a verification goes missing three months later, that log tells you in ten seconds whether the sender changed or the filter tightened. Blacklist monitoring on the catch-all domain side is not enough here, because the problem is the directory’s reputation, not yours.

Choosing Catch-All Email Domains Without KYC Friction

KYC friction is the point where most citation campaigns stall. You have the spreadsheet, the aliases, the Thunderbird filters, and then a provider asks for a passport scan and a utility bill before it will hand over a mailbox. For agency work with dozens of locations, that queue alone can eat a week. The alternative is a no KYC email service, but the tradeoffs need to be understood before you move a live campaign onto one.

Start with what the provider actually gives you. A catch-all email service for citation work needs four things: a wildcard email setup so every alias under the domain lands somewhere, POP3 and IMAP access so your email client can pull mail, and a real mailbox rather than a forwarding-only relay. AllMail provides catch-all email addresses with POP3 and IMAP access, accepts crypto payments, and requires zero KYC. That combination matters because forwarding-only services break the moment a directory sends a verification link that expires in 15 minutes and the forward is delayed.

Now the tradeoffs. Anonymous catch-all email domains split into roughly three tiers, and each behaves differently under citation volume:

• Shared domains from bulk providers. Cheap, instant, no identity checks. The problem is that thousands of other users hold aliases on the same domain. When a handful of them run an email scraper or a registration bot against directories, the shared domain reputation drops and your verification mail starts landing in spam. Some directories blocklist entire shared domains outright.
• Your own domain on a no-KYC host. You register a throwaway domain and point it at a catch-all host. Reputation is yours to build or burn. This is the workable middle ground for local SEO citations, provided you check the domain’s history first and keep one domain per client cluster rather than one for everything.
• Provider-supplied subdomains. Some services issue you a subdomain under their main domain. Convenient, but you inherit the parent domain’s reputation, good or bad, and you cannot move it later.

Deliverability is where the anonymous route shows its weak side. No-KYC hosts rarely offer dedicated sending IPs, so outbound mail for password resets and directory replies can get throttled. Inbound is usually fine, and inbound is what citation work depends on. Test before committing: send a verification-style message from a shared-IP source to an alias on the candidate domain and confirm it arrives within two minutes. If it does not, the host’s inbound filters are the problem, and section 5 of this checklist already told you what that costs.

Reputation monitoring is not optional on anonymous domains. Ask whether the provider runs DNSBL blacklist monitoring on its mail infrastructure and publishes the results. AllMail monitors DNSBL blacklists, which is the minimum bar. Pair that with your own check: query the domain against the major domain blocklists once a week during an active campaign, and keep a spare domain warmed and ready. Domain replacement support matters here too. AllMail provides domain replacement support, so if a domain gets burned mid-campaign you can swap the catch-all to a fresh domain without rebuilding every alias by hand.

One more policy check before you pay. Confirm the provider permits automated alias creation, since a citation run for 40 locations needs 40 aliases in an afternoon. Confirm there is no per-alias fee. Confirm the account survives a payment in crypto without a follow-up identity request thirty days later. A 3-day free trial, which AllMail offers, is enough time to run a full test cycle: create aliases, submit three citations, catch the verification mail in Thunderbird, and watch for silent drops. If all four steps pass, the domain is ready for the campaign. If any step fails, you have lost three days instead of a client.

The checklist is only worth the paper it is printed on if you actually run it before the first submission, not after a listing goes dark. Pick one domain, walk it through the five gates in order, and log the result for each. Confirm the domain is clean against the DBL and against a manual search of the business name plus the domain string. Build the alias-to-location-ID sheet and freeze the naming convention before anyone types a directory URL. Set the Thunderbird filters and send yourself a test message from each alias so you know the routing works. Then run the silent-drop test: trigger a real verification email from the directory, watch the catch-all inbox for 15 minutes, and check the host’s spam quarantine log if nothing lands. If the message vanishes, the host is filtering shared directory IPs and you need a different sending domain or a different host before you burn more submissions. A provider like AllMail gives you POP3 and IMAP access, DNSBL monitoring, and domain replacement support, which makes the swap cheap when a domain does go bad, and its 3-day free trial is enough time to run the full checklist on one domain end to end.

Keep the checklist as a living document, not a one-time exercise. Re-run the DBL check weekly, because a domain that was clean when you started can pick up a listing after a few hundred submissions. Map every new location to a fresh alias the day it is created, not the day the citation goes out. When a domain does show up on a blocklist, swap it out using the provider’s replacement support and update the mapping sheet in the same session so nobody submits from a dead domain by accident. For teams running GSA SER, RankerX, or Xrumer alongside manual citation work, the same discipline applies: the tools do not check reputation for you, so the checklist is the only thing standing between a clean campaign and a month of wasted verification emails. The next step is simple. Open the domain you plan to use this week, run the five checks, and write down the result. If any gate fails, fix it before you submit a single citation. The cost of a 20-minute audit is nothing next to the cost of rebuilding a citation profile on a burned domain.