One per organisation — however many that turns out to be. For most people that's a few hundred over several years, which sounds alarming and isn't, because you never create them in a batch and never manage them as a set. Fewer than one-per-organisation loses attribution, which is the main benefit. More than one-per-organisation adds nothing.
Why one per organisation is the right granularity
The number falls out of what you're trying to achieve rather than being chosen.
You want an address to identify its source when mail arrives that shouldn't. That works if — and only if — exactly one organisation was ever given it. Share an address between two companies and you're back to guessing which one leaked it. Create several for one company and you've added bookkeeping for no additional information.
So the count isn't a preference. It's however many organisations have your address.
Why the number stops being frightening
Two hundred aliases sounds like two hundred things to maintain. In practice you interact with exactly one at a time: the one you're creating at a signup form, or the one you're switching off because it started attracting junk.
There's no periodic review, no reconciliation, no list to keep tidy. With a catch-all setup there isn't even a creation step — the address exists when you type it. How that works
The tempting mistake: category addresses
Grouping by purpose — shopping@, newsletters@, finance@ — is the obvious way to keep the number down, and it's the wrong trade.
You keep the filtering benefit and lose the attribution one. When shopping@ starts receiving mail from a company you've never dealt with, you know a shop leaked you — but not which of the forty. You also can't switch it off without cutting off all forty.
Since per-organisation addresses cost nothing extra, the saving is imaginary and the loss is the whole point. Naming so it stays manageable
What about limits?
Depends where the aliases live. Provider services have plan limits — some free tiers give ten, others are effectively unlimited. On your own domain with catch-all, there's no meaningful limit because addresses aren't objects that get created until mail arrives for them.
If you're choosing a service and expect to run per-organisation addresses long term, check whether the free tier's limit is a ceiling you'll hit in year two. Current limits across services
Growth over time
Roughly: a handful in week one, a few dozen after six months, a hundred or two after a couple of years. The rate is simply how often you sign up for things, which for most people is more than they'd guess.
Old aliases don't need pruning. A disabled alias costs nothing and stays useful as a record — it tells you that company was a problem, which is worth remembering next time you're deciding where to shop.
Where fewer makes sense
Two legitimate cases. If you're testing whether the approach suits you at all, start with a handful on the services you sign up for most. And for genuinely one-off interactions where you'll never need to be contacted again, a disposable address is a reasonable alternative — though the cases are rarer than people think. The distinction
More: the core routine · best practices