Besides that my postfix server is configured to reject connections, where the sending site does not have a reverse DNS mapping. Worked twenty years ago, is still useful today when I check my logs.
What I noticed is that the only spam I get goes to my mail address that's published on my blog and my github address. So it seems that nobody sold my address to spammers, they only scraped Publicly available addresses.
I've been doing it for many years and have already went through quite a few leaked addresses (at least a dozen or two, out of many hundreds). Even a small hotel, not part of any hotel chain, in Portugal in the middle of nowhere has leaked my address.
That said, I believe almost all of those leaks were due to websites or databases having been hacked, not due to them actually selling my email addresses.
When they sell my data (which has also happened before) I tend to get spam from actual businesses, often related ones. When the email gets leaked, I tend to get huge amounts of generic spam/scams (e.g. "your device was hacked!!"). You also tend to find the latter addresses on haveibeenpwned.com.
IMNSHO: sysadmins who do not know that the local part of an email address is not of their concern (as long as it complies to RFC 822++), are not worth their money. And web designers? Don't get me started on that topic ;-0
Edit: ok, they even allow "." and "-" in local parts.
- Fastmail masked emails (https://app.fastmail.com) - Firefox relay (https://relay.firefox.com/) - SimpleLogin (https://simplelogin.io/)
There's many more.
That, and the UI for disabling masks is much easier than having to create a new filter.
For example, if I get an email at [email protected], that will go directly to spam. I use this for everything from Google to every small website I sign up on. They usually only spam anyways. And I check my spam every now and then for if there's anything important - there has never been.
I consider whatever most normal businesses send me spam as well, as I don't care for most of it. Uber Eats, for example, sends a number of emails per each order. That is just spam in my eyes. If I'll use a service I care about, I'll give it an email with a different alias suffix that will never go to spam. But I almost never do.
This has keep out the phishing spam when websites leak my email address just as well as the regular "important information about a minor interaction you did with us" spam that comes from most websites.
The problem is that I still need a general address for my website, resume, HN profile, Git author info... So I still accept mail to a handful of publicly available addresses. However it does let me play with the spam rules a bit more. Signed: auto-accept, known address: moderate spam filter, unknown address: heavy spam filter.
I have my own domain name for email. My email box accepts anything that goes the domain. I.e. a catchall email account.
However, I give a different email address to every site and service. I.e. [email protected], [email protected]
This lets my email reliably get auto sorted by who its from.
But I also use a consistent form to the names I hand out, so that random email that comes to my domain gets deleted instantly and I never see it.
I almost never get spam. But sometimes some service leaks my email somehow and I start getting some. So I change my email with that service (or cancel it) and add that email to a manual list of incoming addresses to block.
It's so dead simple, I feel like all email programs should have the option of working with a whole domain this way.