Catch-all (*) setup is the best, until a spammer hits a gibberish localpart (on purpose) and your domain cheerfully accepts it.

Don't get me wrong, I use catch-all too (don't tell spammers).