I've been doing a similar thing for year with the gmail feature that lets you add "+anything" to the end of your email address. If someone starts spamming myrealemail+thethingIusedforthatsite@gmail.com, it's easy to create a filter to trash it automatically.
I've tried the catchall method on a domain I control, but got way too much spam people trying random addresses.
I have first@last.io. My mail provider (fast mail) supports sending mail to service@first.last.io. This then ends up in a folder called service, or in my inbox.
If a site has broken email validation and I absolutely positively NEED to use it, then I'll grudgingly create an explicit alias just for that site. Otherwise, I find a competitor that doesn't screw this up. In both cases, I end up passively-aggressively tweeting about the company's email validation, though.
I've tried the catchall method on a domain I control, but got way too much spam people trying random addresses.