Best way to handle email address for use with domain registration?

Question

I have registered a domain that I use exclusively for email. In addition to my main email address ([email protected]), I have [email protected], [email protected], [email protected], etc. I pay an email provider for this service.

I also have a free Gmail account, which is what I used as the contact email for the registrar. I have concerns about the security and stability of my Gmail account, and I'm wondering what the best approach is with regard to these concerns.

I feel like it's a Bad Idea(tm) to change my registrar's contact email to [email protected] (or anything @example.com) since I could end up with a catch-22 situation if my account were to be compromised.

If my Gmail account were to be compromised (or otherwise disabled, say due to a Google error), I would/could lose the proverbial "keys to the kingdom". Right now, I can't say that I feel completely comfortable having Google as a gatekeeper here. Same for the other free email services (Yahoo, Hotmail, etc.).

Options I've considered include:

• Creating a separate (free? paid?) email address solely for use with my registrar
• Paying Google for email (assuming better customer support and less likelihood of a Google snafu)
• Using 2FA/U2F on Gmail for extra security (though not extra stability per se)
• Doing nothing - nobody wants my crap LOL

I feel I generally take a proper approach to security - not too careless, not too paranoid - but I'm struggling with the correct approach here.

Any advice is appreciated.

Answer 1

Consider the following situation. You have your registrar under a Gmail, Hotmail or other free account, and you get your account hacked, with no way to restore it back to you. In this scenario, you may as well lose all access to your domains as well.

What you could do is register them under the @example.com domain, and have that mail forward the emails received to your Gmail, Hotmail, etc account.

Scenario 1: Your free account gets hacked You simply change the forward in your domain configuration to a new account, and you get your access back.

Scenario 2: Your hosting account gets hacked You can contact your hosting provider for direct support, and they should be able to help you, provided that you can verify your identity with them (last credit card used, login details before the hack, etc).

And yes, by all means always enable 2FA if possible to minimize your exposure.