A catch-all is not a good idea. But Migadu lets you do something called pattern rewrites which are aliases that can contain wildcards. So you can set up a pattern like shop-*@yourdomain.tld and use addresses like shop-amazon@, shop-etsy@ etc.

It doesn't have to be "shop" you can use anything you want and make up the pattern in any way you want ("ama.shop.zon@" or whatever you can think of).

It's better than plus addresses ("realaddress+amazon@") because it doesn't have to include your real address, and you can make a pattern that nobody can guess, but still retain the ability to use one address per site so you know who's spamming you, and you can make them up on the fly.

In fact I no longer use my "real" address for anything except logging into IMAP and SMTP, I use aliases or patterns for everything else.

Edit: If you want to also be able to send email from these addresses make sure to enable "wildcard sender" for the associated mailbox.

These addresses do have one downside similar to catch-all: if one of them starts getting spam you have to make an explicit deny rule for it. Some people contend that this is a messy approach and they'd rather make regular (non-wildcard) aliases and deny everything else. The downside with that however is that you can no longer make up addresses on the fly, you have to go to the Migadu admin to create the alias every time.

"It works for me" (C)

Spammers don't bother scanning domains as much nowadays. They used to watch domain registration then spam addresses like admin@, contact@, office@ etc. but nowadays most people aren't dumb enough to use those anymore. So spammers would rather buy a list of millions of addresses that someone else obtained by breaking into sites like Yahoo or LinkedIn, which are much more likely to be valid addresses.

You can get bitten by catch all if someone who knows you and knows your domain and knows you have a catch all has it in for you and subscribes addresses at your domain to mailing lists and other spammy places. 😊

Actually (and surprisingly), I don't. Maybe it's due to WHOIS privacy.