For my custom domain I set up a catch-all so *@sharparam.com gets routed to my main address. If I end up needing to reply from such an address I set up a proper alias for it (currently I use GSuite to manage it).
This is useful for detecting the origin of spam, however it’s trivial for a spammer or hacker to workaround (just strip the plus and anything after it before sending)