I go a little farther. I figure an attentive spammer might figure out that if I use [email protected] to sign up for Amazon, I may have exactly the scheme where *@johnsmith.net will work, so they can just add that to the spam list as a wildcard and pick a new address every time. So instead, I use [email protected], john102, john103, etc, to try and obscure my strategy and prolong the life of the domain forwarding.
Also unless you're keeping a lookup table you're losing a great benefit of the wildcard. You can, and I have caught a few places, tell when a company sells your email. If I get an email from company XYZ to my email [email protected] I know exactly who sold my email and to whom.
> unless you're keeping a lookup table you're losing a great benefit of the wildcard
That's true, I don't keep a lookup table per se, though I do have a deleted items folder that I could look back in. I'm not sure what I would do, though, if I knew what particular company sold my email address? Send them a nastygram they will just ignore? I just block the address and move on.
AFAIU, most buld spam is targeted on gullible or vulnerable people. The spam is often terrible on purpose.
Sophisticated or targeted attacks are a different category and they may be a good reason to prefer something non-guessable.
At least a few years ago, I noticed a lot of spam to <random first name>@<my domain> -- i.e., completely made-up addresses that I had never used. Since messages sent to those addresses were guaranteed to be spam, I started treating them as free training data for the spam filter.
I don't know if this still happens, though, because I haven't looked.
It seems like an obvious thing to try, but maybe not worth the effort of implementing it, given the high risk of false positives and the low % of people who actually do stuff like this (not to mention they're probably not people who click on ads anyway).
I have found this to work; I hardly receive any spam at all, and do not need any separate spam filter.
Additionally, sending a test email like that might also get the sender placed on a black list for triggering a spam trap inadvertently.
Do you know any site blocking domains with a catchall?
Worse, I know at least 5 or 6 people personally, which do catch all. It seems like a very poor method to reliably catch spammers.