Every catch-all gets a score.
The score is a probability, learned from real sends: what delivered, what got a reply, what bounced.
We weigh what we know about the address and its domain, signal by signal.
Examples. 80% and above is marked safe to send by default.