Tip: use a subdomain as your catchall (e.g. [email protected]). I've been doing this for five years and haven't gotten a single spam to a random address. While there are various ways to learn about a domain's existence, subdomains fly under the radar.

That is an awesome tip. I stopped using a catch all when folks were doing reflected spam (trying to get my mail server to 'bounce' the email back to the spam target).

I'm curious: did you lose any emails when you turned off catch-all? I would like to turn off catch-all, but I receive a lot of (mostly automated) email to various addresses, and I don't want to set up a long list of email aliases.

My catch all dumps the from line and the subject line and date into a log. I've got a perl script that scans it once a week for anyone in my contacts list. I did create a set of ecommerce/web site aliases which are all structured similarly ([email protected]) which are processed separately.

When I moved away from catch-all, I analyzed my emails from the past 5 years to find all the email addresses I used (grep on my Maildir to find To: *, and then uniq) and then simply added ~15 forwarders. Haven't missed anything I cared about since.

Interesting! I'm gonna try it out and see if it works. But I'm wondering why?