1. Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you.
2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to:
3. Password manager. Just do it.
4. Use the highest security options available at each website. If it's just 2FA, do it. Yubikey is great if they offer it.
Note that email on your domain opens you up to a different sort of risks along the lines of domain hijacking / registrar account takeover. However, if you pick a good registrar you should be okay, and also there are commercial/legal remedies available.
#2 is always fun when you're dealing with humans directly. "Yes my email is <yourcompanyname>@<mydomain>.com. No I don't work for the company, it's so I can track where emails come from. Yes I work in tech."
A lot of orgs will (for security reasons) treat your Google OAuth login, and a email+password login as two distinct accounts, even if they are on the same email address.
So it is possible that if Google shuts your account, and you migrate your email to a different provider - you will still lose access to your service account.
> Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you.
And if you give up your domain then someone just have to buy it and use the "forgot password" option :D
You do have some additional management overhead, but a good registrar will bug you well before your domain expires if they aren't able to auto renew it for some reason. You also have a 30 day grace period after it expires before someone else grabs it.
They need to bug me by mail and by phone. Last time my payment couldn't be processed, I lost email for a week (didn't notice because I was reading email in an email client that pulls from both my custom domain and gmail). Once I brought the domain back up, many of the missed emails did come through including ones from the registrar saying that I needed to fix my payment info...
I had a similar scenario happen, where my domain expired without me realizing and my incoming emails slowed down as DNS caches expired. I finally realized it after a few days when I hadn't received an email that I was expecting, and once I renewed the domain I got a flood of emails that I had missed.
After that, I was much more careful about where my domain registration emails go.
I only noticed because I was expecting a specific email too. I should have realized sooner but I was blaming not getting account confirmation emails from a service I was trying to register for on the service itself. I remember that I was even trying multiple browsers and devices thinking that the client was failing to properly send something to the server!
I shouldn't have said they "need" to. More like it would be very much appreciated if they did. I've made sure to keep track of that now, but I think they could do a little more to help people, who haven't learned from making the mistake yet, avoid losing their domains.
Funny thing is that I had a domain with a different registrar about 9 years ago and I couldn't get them to stop mailing me expiration reminders. They kept coming well after I intentionally let the domain expire.
Don't build your castle on someone else's property.
If your Google account gets suspended for some reason, that will likely take you down for all other Google systems.
You don't want to have your entire universe shut down just because one person out there decided that they didn't like you and complained to Google that you were spamming them.
This kind of thing has happened before, and will happen again. Do you want to take the risk it will happen to you?
2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to:
3. Password manager. Just do it.
4. Use the highest security options available at each website. If it's just 2FA, do it. Yubikey is great if they offer it.