I usually go for <company>@example.com where
<company> is the company I’m handing my address to. After a breach I route that address to /dev/null
You want something that is sufficiently random that it can't be easily guessed or gamed, but can be quickly and easily determined on your side.
Salted cryptographic hashes might be a good place to start.