I used to just use my gmail account and forward it, but recent stories caused me to evaluate how to eliminate the Gmail weakness.
You may change the email address with your domain registrar at any point in time to manage future risks.
My suggestions:
* stick with a (preferably paid) email account on a domain that's not yours but is likely to be around for a long time
* choose one of the common TLDs like .com or .net or .org for the email address (these TLDs have the least likelihood of disappearing or being blocked by anyone)
* make sure you keep the email address active (by logging in and/or paying on time)
I have been and will always be using exchange from a reputable source (in my case OVH). I pay money for my email because its now their problem to keep it running. After that I add dns protection to my domain so it can not be changed on a whim. For it i have like 100 aliases setup which I give out to the vendors I use.
But yes, after initially signing up with a freemail, I changed my main email to the one provided by OVH. Why? because I can verify myself with my invoices even if two FA and everything else has been taken over.
There really is no ideal setup, because email was not designed for it. Its a messaging protocol and not an auth mecahnism, that it can be used that way is coincedence.
USE 2FA. Use a dedicated device for auth, because those are designed to be with you at all times. Like actual keys.
The probability that someone will actually hack your icloud backup with your 2fa app backed up into it, are way less likely then one of your passwords leaking.
- backup emails and/or
- editable email field(s) that is secured by your 2FA/MFA/SMS/TOTP
Obvious downside: you gotta keep real careful track of where you use an e-mail address like that. If it's your "final/reset" contact, and you change ISP's...
I use Protonmail for both and it works perfectly.