> nobody is sending email to alsdkjfadf@domain

That’s actually the kind of spam I used to receive on a very short domain with a catch-all.

I guess they loop through short domain names and then try to brute-force the local part.

Interestingly, I have <3letters>.one but I think because it's an uncommon TLD and a seemingly random 3 letters, I haven't had that issue.

You are right. But I think using a catch all with a separate username for each service/business is becoming an increasingly common practice so I would imagine it’s only a matter of time before spammers catch on and begin exploiting this.

I use service name + 4 random alphanumeric characters. Seems to strike a reasonable balance between just using the service name vs. completely random characters.

Then we adapt.