Instead of [everything]@example.com, I set up [everything]@yo.example.com. Discovering subdomains is much harder and the one time I encountered a form that didn't like a subdomain, I just made a forwarding address on my main domain.
Using Fastmail's rules, I have a setup where every message arriving to @yo.example.com gets shunted into a folder unless there's a different rule putting it somewhere else.
Is this because you don’t publish MX records in DNS for the subdomains and the default setting on the main domain is to accept only specific addresses (and reject catch-all addresses)?
The spam I've received on my catchall is either based on previously breached sites (which I once signed up to) or to very common mailbox names (e.g. postmaster@, info@). I just add those to an auto-reject postfix filter based on the intended recipient, which keeps my inbox very clean.
Gmail handles the rest.
Login via Google / Facebook / Whatever is sometimes helpful, but it usually results in SPAM. For example, I logged into Redfin through Google and they immediately started spamming me.
Other times, when I login through Facebook and disable sharing my email, the site that I'm trying to log into has a "mystery error" because the concept of not sharing my email address never occurred to whoever wrote the integration.
Most of the time, I just use a unique email address with each site. My domain has a catch-all email address, so when someone starts spamming it, I know who did it.