I use qmail, where - has been the extension for, well, since it was created. If you're a postfix person, you can use + or -, with recipient_delimiter.

You're less likely to bump into issues with -.

Some shops don't like their trade name in the email, so rot13 (g? in vim) solves that if your goal is to trace back the leaks. I have not found a reliable way of auto dropping mail from bad sources, sometimes companies change name which makes it hard to validate From with recipient.