I currently overwork the catch-all/matching part to support way more options. (Gmail style, timestamp invalidation, subdomains, blacklists ...)

Right now my approach is to have a [catch-all]@domain.tld enabled, and then build rules for individual domains i want to blacklist.

However sounds like you figured out a nice setup that works for you. So you are not the target audience anyway :)