I use different email addresses for everyone, and have a catchall on my domain. Been using this setup since the late 90's. My spam comes from a few sources: -

I use different email addresses for everyone, and have a catchall on my domain. Been using this setup since the late 90's. My spam comes from a few sources: - data breaches that leaked an email address (Adobe, Dropbox, LinkedIn, GoDaddy etc) - family that used to forward all kinds of crap using the TO: field instead of BCC: - some companies sold my email which then started to propagate more and more - some just figured it out. If you own a domain firstlast.com you'll get spammed at first@firstlast.com - dns records There are more I'm sure. These are the sources I'm certain of. Your email is only as secure as the weakest link that has that address.