Two things about fronting with your own domain:

1. You have to own that domain forever, until or at least until you're 100% confident that an email intended for you will never be sent to that domain ever again. Even then, there are security risks with giving up the domain.

2. You give up some privacy. You can use mailbox aliases but it doesn't really matter if all the mailboxes are tied to a domain registered to your name and address.

Whois privacy is basically standard these days, no?

Yes but all of your aliases would be under the same domain so one could surmise that the same person uses the domain.

You can usually setup several domains. Some domains are very cheap to register, so you can register some inconspicuous, universal, email provider-sounding domain and add aliases at will.

Doesn't completely solve the problem. You now have to pay per (unaffiliated) alias since each requires an independent domain. You also become extremely vulnerable to data breaches because rather than learning that foo@provider is john.doe@provider with IP xxx you instead learn that foo@domain is John Doe, phone number, street address, credit card, etc.

This issue goes far beyond email alone. The ICANN domain system effectively rents a string out to you on a temporarily basis and mandates that an Impressum be attached to it. It's a deeply flawed scheme when viewed from the context of both historical hacker culture as well as the fundamental values of a free and open society.

1. A little money solves this. You can register for 10 years at a time. Any decent registrar will blow up your email near your domain’s renewal date regardless of renewal status.

2. Whois privacy solves this. Free from any decent registrar.

For (1) you can prepay i think up to 10 years? And every year you just prepay 1 year again and you will have 10 years to remember that you forgot to pay a domain registration bill.

That is moving the point of failure to the domain registrar. Which is probably less likely, but you are always relying on someone.

I think that the point here is that your domain registrar will pick up the phone if there is a problem, where Google clearly will not.

I use AWS to register the domain and AWS supports up to 8 different MFA factors. I have totp and 4 different passkeys registered