Just use something like 'servicerelay-<randomdigits>@yourdomain.com' and setup spam filtering rules that lets pass everything received at 'servicerelay-*' and delete or reject everything else.

Adding my disagreement to the chorus— the number of permutations they try on my personal domain is not high enough to warrant an explicit allowlist. I actually don't even have a blocklist; I simply don't receive that much spam.

Most of it comes to two addresses which are public via git (one from commit logs, the other explicitly stored in a repo).

I do what the GP said and I haven’t any problem with “guessed” addresses like that. I do have a problem with obvious spam from a GMail account (which is setup to forward to my domain), so, go figure.

Not an issue for me, so far. And I have been using that domain for over 5 years now.

you can block a specific alias or address from receiving mail in the mail rules, even if you have wildcard rules setup