The way most people do this is with plus addressing. If your mail provider supports it (e.g. Gmail does), you can send email to someuser+somewebsite@example.co

The way most people do this is with plus addressing. If your mail provider supports it (e.g. Gmail does), you can send email to someuser+somewebsite@example.com and it will be delivered to someuser@example.com. There are a minority of websites and apps that reject emails like that, but they are quite rare and the vast majority don't have any issue with it. If you have your own domain name, you can set up a catch-all address, so if you own example.com, then you can register on websites and in apps with somewebsite@example.com instead. This works everywhere. You can then look at what email address an email was addressed to to see how the sender got hold of your email address, and you can filter and block future emails based on that address as well. So if, for instance, you've registered with MyFitnessPal with myfitnesspal@example.com, then you can cut off everybody who's got hold of your email address via the MyFitnessPal breach with 100% effectiveness using one spam rule.