For Facebook, I’m currently completely locked out. I have the right username and password, but the email accounts I used to create the Facebook account are disabled now, being university accounts.

At one point, Facebook wanted my credit card or driver’s license as proof to tenable the account, which I wasn’t comfortable with. Then it got paired down to three randomly chosen connections that I needed to contact outside of Facebook. Once chosen by Facebook, these contacts cannot be changed. For me, it included a deceased person and two people I haven't even seen since high school. Now, it just wants to validate the email addresses with no other options.

So now what? Nothing in my control ever went wrong. I know my account, I am the person, and I have the username and password. It would be nice to be able to just call a number with a human on the other line to verify that it is me.

We've entered the era of "death by scale". We and the government allow these companies to treat customers and people as statistical entities. They don't give a shit if their products either flat out don't work or ruin a customer's life for "only" x percent if x is small enough.

Do people use custom domain names to get around the fact of switching email providers? Aren’t there rejection/filter issues when using custom domain names?

I rarely needed to ask for support, but every time FastMail response was by an actual humans, not by a tincans.

I agree that in b), it sucks that once chosen, the 3 people cannot be change (although I kinda see the security angle of it), but what else would you want Facebook to do if you lost access to your email?

I don't understand why it can't just ask me questions about my account. It's not like I'm resetting my password. It was Facebook that randomly decided it needs to send an email, something it never did for the longest time.

For gmail, have several addresses, with redirections to each others, use imap, don't use social sign it.

I also never use social sign in for anything other than using my GitHub account for certain things.

And if FB stole it, congrats, you are rich off the settlement.

You had multiple reasonable options to recover, declined them and now complain that "Nothing in my control ever went wrong". This annoys me so much

TLDR: I actually recovered my old university email address, and Facebook refuses to send a code to that email and has now removed it as an option.

You don't need to host the email servers yourself. Many email hosting services will let you use our own domain with them.

If you want to use an email hosting service that does not directly support using your own domain, many domain registrars include free email forwarding so you can forward mail sent to your domain to your address at your email host, although there might be problems with sending from your domain if you use the forwarding approach [note 1].

It might at first seem that this is just pushing the problem back a little. Instead of the problem being losing your account at a mail hosting service like Gmail, you now have to worry about losing your domain.

The big difference is that a domain registration is a lot more passive. With a Gmail or other mail hosting account it is something you are actively using. Content you generate goes through it. Content other people generate goes through it to you. That gives all kinds of opportunities to trigger false positives on their automated anti-abuse systems.

With a domain you register it and designate name servers and periodically pay to keep it from expiring. Most registrars include basic name service so you don't have to deal with finding a name service provider. Once you've set up name service to designate your email host as handling your domain, or set up forwarding if that's what you are doing, you pretty much don't have to touch anything there and content to/from you doesn't go through those systems so there is simply much less opportunity for something to trigger some sort of automated anti-abuse systems.

Pick you domain and registrar carefully. Don't pick a domain name that is close to some trademark. Pick a top level of .com or .net or maybe your country's top level if you are going to want to send email from that domain [note 2]. Pick a registrar that is not in some country likely to do things that get your country to put sanctions on it.

[note 1] You might not have enough control over the headers on outgoing mail to be able to send a mail that doesn't look like a forgery attempt. For email addresses that you will just need for receiving things the forward approach should be fine, which will cover email needed for account recovery in most cases.

[note 2] The newer top level domains that are available for general use have been pounced upon by large numbers of spammers, to the point that having an email address in them can make it very difficult to get through spam filters. Spammers are all over .com and .net too of course, but that's also where most of the non-spammers are too. With the newer top levels the spammers jump on in large numbers from the start and so from the point of view of a random email receiver those domains are mostly spam.

I've seen a lot of mention of Gandi on HN, mostly favorable.

Although, I have not used any of my domains with email services.

For most users, it’s not a bit of work, but a life changer (as in this case, right). Most sites only allow G and f SSI, and that’s it. Quick registration is a killer feature and it’s a shame that it is not a part of the tech stack at much lower level than google/site integration. It’s almost 20 years of mass-internet and it still sucks at account registration.