I think using servicename@domain would be fine, the common ones like support, webmaster, etc.. are the ones to avoid. And using a unique one per service helps when a service inevitably leaks that email address, you can just change it and block the old one.
post
service@domain.tld won't actually prevent spam, it will just give you the grim satisfaction of knowing which service leaked. I used that pattern for a few years and the only thing it was ever really useful for was figuring out that a service I signed up for years prior had changed their name or used a third party service to handle portions of their site features.
If you're careful about what you sign up for, spam shouldn't really be a concern. The places you're most likely to get spam from are your contacts email getting compromised, sketch online services that go out of business, and big services outsourcing marketing. Just be sure to religiously unsubscribe from any promotional materials because the longer your email remains contactable on a list, the more likely it is to be shared/sold by some shitbag marketing firm.
Compactflax.myfitnesspal@domain gets a TON of spam.
other than that it’s actually surprising how little I get.
But damn that leak went far
Spam is thankfully pretty much a thing of the past. I had to stop using a couple of my primary emails because they were just getting drowned in spam, like a hundred messages a day if not more.
Then Sender Policy Framework came out, which went a long way to reducing spam, then came DKIM and DMARC and it's now really down to very manageable levels, and I've been able to start using both those email addresses again. They do still get some spam, but no more than 1-3 a day now.
You'll regret it the first time you have to read it over the phone to someone. Every letter and number repeated and re-repeated only for the email you expected to wind up in jfavOOhjau4gvncga19@domain (which you should probably be able to see). The computer database you didn't want to have it got it right on the first, and all subsequent tries.
which you should probably be able to see
I've heard (from one person on the internet) some servers might scan for presence of catch-all by sending e-mail to long random string e-mail at the domain, and then potentially sending spam to anything if it doesn't get rejected.
No idea.
My first thought would be that sending an email to every possible random string would be a quick way to get flagged by whatever big city backend blacklisting goes on. If I were trying to set up my own email server for my own domain, unless there's some rule that says I have to, I'm not sending a no-such-address message back. Making a success and a failure look different to the attacker (which I'm going to treat spam senders as for the purposes of histrionics) is giving them a signal for free.
It doesn’t seem to matter much, in my experience. I’ve had my own domain for a couple of years now, utilizing Proton. It could be their filters are just that good, or that my addresses have not really “leaked” yet.
If you are considering using a custom domain, keep in mind that if you want to keep that email address, you will have to keep paying yearly for that domain. In addition to my monthly Proton subscription, I’m paying about $50/year for the domain. I don’t mind paying for it though.
Simply give them their company name as the username. I put fromamazon@mydomain.com and fromtesco@mydomain.com and then when an old account with deadcompany gets pwned, I redirect fromdeadcompany@mydomain.com to junk@mydomain.com with an alias.
I've yet to meet a company that's not ok with this. It's a bit embarrassing when you're talking to a human, but you'll get over it.
I use both formats. Mostly the one with the added random suffix, though. If somebody were to figure out that my domain is an alias and I used only non-obfuscated aliases, it would be easy to figure out how my aliases for the other services could look like. Adding a suffix makes it impossible to guess. I sometimes use aliases without suffixes if I want them to look better to the recipient, or it's an alias of more importance to me, or if I need to remember it more easily, etc.
I use both. For most services I use the service name in the email address. It's for me, not them. I get to see who its from, who sold my data or got breached, or who got bought and changed their name. If I ever need to tell it to a real human they always think its odd and I simply say, that's how I prevent spam and they light up because they are jealous I have zero spam (maybe 4 or 5 in the past 7 years and most went to my catch all)
For smaller services like my local pizza place, I use a randomized alias (I still put their initials in it to help identify it). The reasoning is that I have absolutely no trust that they have any kind of security on their website or janky payment platform, and I highly expect massive ad tracking from that platform. Side benefit is using burner email and phone number let's me reuse one time coupons.
all 19 comments