Using a catch-all domain is a mistake

I've been doing this for well over a decade and while I had similar experiences sometimes, I don't see how this was a mistake by any means. Yep, not many companies sell or leak your email, but some do. And let's not forget that 10+ years ago we had much worse spam filters. (Though we had less spam as well.) And using a unique email for each provider and company it's pretty easy to block them when they start spamming you or when they give away your address.

In theory, one could use generated addresses in some cases. E.g. for throw away ones or when you have to give it in person. The problem is that then you'd have to keep track which one you gave to whom.

It also helps with filtering as services may change the from address or use multiple from addresses while you may want to label all email from them the same.

Then in some cases, where you do want to make your email public still you want to know how people found you. I think this one would be called "role based addresses". E.g. I think it's pretty nice to have your paypal address as paypal@yourdomain.com (when people were still using them for a lack of alternatives), same for github, etc.

this doesn't solve the SMS 2FA problem but if you know what you're doing with voip you can set up a DID to answer with a filtering message like "please press 8675 to be connected", and it'll only ring your actual phone if somebody follows the instructions. cuts down on 98% of telemarketing and scams.

then only give out the DID number not your direct phone to things like car dealerships.

i had one car dealership that I took my car to for an oil change one time that persisted in sales calls for six months until I finally escalated the matter to their general manager.

What do you use to manage all the subdomains?

Cringe take, but fair enough on the bank freaking out part.

My interaction with them went like this:

>staff: And what's your email address? >me: $BANK_NAME@$MY_DOMAIN >staff: chuckles

And on the next day I got my bank account flagged.

Edit: Turns out the restriction was not related to the email address. It was a red Canadian bank.

I would say large banks like Citibank, DBS or HSBC would never care to this since all external emails are written to have a huge 'EXTERNAL' in the subject and a disclaimer before the content.

I use catchall domain for... everything. Every account at every entity has its own unique address, since probably well before 2010. I have always more than happily accepted to have my address saved into marketing databases.

I can share the frustration sometimes with employees turned sudden internet experts and "teaching" me that my email address cannot start with their employer's name. I usually retaliate by withdrawing my consent to be registered into their database.

And that ends there, I disagree with everything else in the blog post.

1. Catchall facilitates blacklisting when it becomes necessary: whatever rotating address is used by the sender, I blacklist myself as the recipient.

2. It helps detect who shares databases with whom. This is not necessarily about "selling" but more often it taught me which companies operate with which companies under the umbrella of that "and our partners" statement found in every privacy policy written by legal consulting firms.

3. It's a smoking gun for companies wbo get hacked without even knowing it. I have been informed several times of a compromise before the company itself knew it.

4. I also use suffixes on my catchall addresses, this allows me optimize my email filters.

5. It makes correlation more difficult across databases and anything that helps achieving this goal is a win for me.

6. I use a password manager, I use both the login and the password fields. The title of the entry always allowed me to find the account very efficiently.

I can probably find other reasons, I'd just conclude that after more than 10 years using a catchall domain, I still can't imagine sharing the same identifier across all my interactions.