I use a catch-all subdomain (like *@something.mydomain.com) that simply forwards to my main account. I then sign up on sites using something like news.ycombinator.com@something.mydomain.com or hackernews@something.mydomain.com.

I've been doing it since ~2001. The only downside is long e-mail addresses, but my password manager deals with that for the most part.

Subdomain is important, otherwise you get dictionary-style spam email attacks (as well as everything coming to whoever owned the domain before you, if anyone). I've never noticed that style of attack to the sub-domain.

I've also got very little actual spam to this. A handful of e-mail addresses were obviously leaked/sold but by far the bulk of the spam I get comes to my primary e-mail address which I never use to sign up for anything.

I've been doing that for over a decade. It's great. If I get a phishing email about my iCloud account, but it's sent to my yahoo@mydomain.com then it's obviously a phishing attempt, not need to check for other markers. You can also see who has sold/leaked your email address for marketing purposes.

Not OP, but just a guess: you can use tags in your email (add `normal-email+tag-here@domain.org`) and it should go to the same location. If you host your own mail or have your own domain with an… M record? I don’t know—then you can easily create as many emails as you want and forward them to other accounts.

I have a domain just for emails, so any mail sent to the domain goes to me, so I can just sign up for a site as hackernews@mydomain.tld or whatever system i want for naming stuff. I still get every mail to the same mailbox, but if I start getting spam, I know which site sold my email, or got hacked.