The other problem I ran into is spam+sitename@mydomain.com is really awkward to read over the phone. I ended up switching to sitename@email.mydomain.com, which

The other problem I ran into is spam+sitename@mydomain.com is really awkward to read over the phone. I ended up switching to sitename@email.mydomain.com, which passes all validators and doesn't sound as sketchy. Using a subdomain, I don't seem to catch any of the spam that gets targeted to catchall domain addresses. Also, I once encountered a site where spam+xyz worked for signup but failed validation on the login form. I think it was something important too, like a utility or bank.