Do you have catchall directly on the second level domain (@mydomain.com) or do you only catchall a specific subdomain (@mail.mydomain.com)? I'd expect a very big difference in the volume of blue sky spam between those two. If GP sbov has the catchall directly on mydomain.com, then restricting the value space to *.r will make a meaningful difference.

Having the "validating substring" in front of the @ will actually make it easier when you have to use the email address in vocal communication: many humans are unaccustomed to encountering more than one dot after the at.