I've long wondered if you could put crypto into this, to make it secure from a human attacker who might figure out the scheme. Otherwise it is relatively easy for a spammer to replace foobar.com with google.com and email you again, escaping your filtering and/or making you think google.com has a data leak.

For example, using a HMAC of the domain. So you generate foobar.com-sr32j4@mydomain.com, it's impossible to generate the sr32j4 part without knowing your secret key, and your mail server checks that sr32j4 is correct before accepting the mail.