Also some websites won't let you put + in the address despite it being a valid character per protocol. Crippling email sign ups for one company, astonishing.

Fastmail has subdomain addressing. eg. [email protected] which is a lot harder to detect.

I like Yahoo's approach-- they do their disposable email aliases like this:

[email protected]

Where basename is user-chosen (and not necessarily related to the real email address), and the suffix has to be registered ahead of time (so a spammer can't just start randomly generating suffixes to avoid filters).

Also you have to maintain the rules filtering out all the +spammers indefinitely. Presumably with this service or something like it, whenever you wanted to you could just create an entire fresh id. (As well as the ability to turn off specific addresses as they describe.)

Couldn't spammers just start sending to (rand).username@mailhero ?