I have owned my own personal domain for about 25 years and used it for email over that interval. I have usually used a wildcard alias acceptance, which lets me see what spammers and phishers are sending to my domain. Many years ago I would see some dictionary attacks to random usernames and common user names. But this is very rare now, and nearly all of the spam I’m receiving fits into one of the following categories:
- Messages sent to aliases I use now or have used in the past which I commonly use and so can eventually be discovered. Such email addresses are on my retirement business card, websites, newsletters, and the vast majority of the email I send each day.
- Messages sent to aliases I specifically created for one particular use (such as a bank or other company) which is unusual and has not been released to anyone else. If I get spam to such an address, i know for sure that it was obtained by that company somehow releasing my address by selling it or (more likely) a security breach at that company or (often) an advertising partner.
- Mistakes - I get both spam and non-spam normal personal and business emails sent to my domain name with an incorrect TLD. My domain is not at .com, and people continue to send me messages which should go to someone at the corresponding .com domain. The username (part to the left of the @) is actually used by a person, but at a different domain.
How do I know this with high reliability? It’s because Fastmail has a feature which allows you to file all email sent to an alias which does not match any existing alias into a particular label or folder. So I have a “wildcard” label (similar to a folder) which only receives emails sent to an alias or subdomain which I have not configured.
Bill