I've found using a subdomain helps with that, spammers will try everything@domain.tld but won't bother trying to brute force subdomains.

However be warned some surprisingly large websites don't support subdomains, for example eBay will silently send user@sub.domain.tld to user@domain.tld and you'll only figure it out by looking at your server logs for rejected mail.

In those cases I have to specifically alias that username@domain.tld to the subdomain.

With this new Apple privacy subdomain maybe eBay will finally fix this.

Why would anyone entrust money to a company like eBay if they are this incompetent at something as simple as e-mail?