I literally get only 1-3 real spam mails per month without any filter.
Maybe I should start using random words though? Wonder if someone will go bananas seeing their brand's name on my domain.
Actually, I am surprised _any_ spammy website these days would even honor the part after the +, and not just directly send to the real mailbox name.
And a "malicious" actor can get away with pretending to be another company by spoofing the username if they know your domain works like that. I don't think this has reached spammers' repertoire yet, but I wouldn't be surprised.
Eventually I'd like to have a way of generating random email addresses that accept mail on demand, and put everything else in quaraintine automatically.
https://people.cs.rutgers.edu/~watrous/plus-signs-in-email-a...