I highly suggest using a catch-all on a subdomain, not a top level domain. Top level domains get dictionary-style spam/phishing storms (eg alice@, bob@, charlie@, etc), but those don't seem to occur with subdomains. You can also create just an MX record for a subdomain, which helps 'hide' it to some extent.

The first time I setup a top level catch all, I had the first dictionary style attack within a day or so. I've been using a catch-all mail-only subdomain for well over a decade, and have had no such attack.