I've heard that being a problem, though I've never had that issue using a sub-domain for the catchall ([email protected]).

Some sites refuse to accept email addresses with more than one "." after the "@" but figure if they don't understand email addresses I don't want to trust them with my details (even throw-away ones) anyway so go elsewhere.

Gmail allows you to do extension addresses like "[email protected]", which I've used since switching away from my own mail server where I did the catch-all. Some places are rejecting "+" in the address though. I was trying to give on to Dell and the tech I was talking to told me the system wouldn't accept the address, but that the "+dell" was just an extension "so can I put it in without that?"

The combination of them knowing that this was valid and just wanting to strip off the extension kinda blew my mind for some reason.

I can confirm exactly this. I started with a root catchall on my personal .com (~15 years ago), and it was quickly overwhelmed with dictionary spam. Switched to a subdomain catchall, and haven't seen a dictionary run since.

Picking a short preposition for the subdomain can even help when you have to communicate the email to a clueless phone rep: "That's right, it's [email protected]"

Lots of sites also strip the "sub." part from the domain. I have no idea why they think this is a good idea, but a friend of mine does this and he's got at least ten companies in his main domain's alias table because they silently stripped the "sub." part.

The way I get around that is by having a static keyword that must also appear on the user side of the email address.

So, if I'm dealing with Walmart, I would give them:

[keyword][email protected]

or

walmart.[keyword]@example.com

Then I configure my catch-all settings to reject any email addresses that don't have that keyword.

Of course, the keyword is not secret, so it's possible for someone to infer what I'm doing and construct an email address that passes my spam check, but in practice, nobody goes through the trouble, because I'm not a big enough target.

Yeah, I wound up using name-tag@domain, but because I used a dash rather than plus, I'm forever doomed to run my own mailserver.

(fwiw, this domain is almost 20 years old, so that's forever in internet years)

I use my domain with FastMail, they support aliases and catch-all and lots of other nice things on custom domains. They also do DKIM, SPF, etc. So you don't have to run your own mail server if you don't want to ;)

https://www.fastmail.com/help/receive/domains.html

https://www.fastmail.com/help/receive/domains-setup-mxonly.h...

https://www.fastmail.com/help/receive/alias-catchall.html

https://www.fastmail.com/help/receive/addressing.html

https://www.fastmail.com/help/receive/domains-advanced.html

Fastmail uses a +, I use a -. So, either I'd have to go in and alias all of them, or give up on the useful ones.

Besides, there are 30 or so that I have black holes, from back when comment systems leaked email addresses.

Sounds vaguely like the way email addresses work in Ender's Game - typically, all mail would go to user%SECRET@server, and if you don't know SECRET, the email presumably bounces.

I haven't had any issues with that and I've been using a catch all setup for about 7-10 years. Most spam arrives on the actual primary email address.

This was a while back, and I'm guessing that now there are enough gigantic lists of verified emails that the technique lost it's minimal rate of return.

It was a massive headache at the time tho.