Its allwayas a problem in the beginning but yes email is the defacto -auth- mechanism out there. I have been and will always be using exchange from a reputable

Its allwayas a problem in the beginning but yes email is the defacto -auth- mechanism out there. I have been and will always be using exchange from a reputable source (in my case OVH). I pay money for my email because its now their problem to keep it running. After that I add dns protection to my domain so it can not be changed on a whim. For it i have like 100 aliases setup which I give out to the vendors I use. But yes, after initially signing up with a freemail, I changed my main email to the one provided by OVH. Why? because I can verify myself with my invoices even if two FA and everything else has been taken over. There really is no ideal setup, because email was not designed for it. Its a messaging protocol and not an auth mecahnism, that it can be used that way is coincedence. USE 2FA. Use a dedicated device for auth, because those are designed to be with you at all times. Like actual keys. The probability that someone will actually hack your icloud backup with your 2fa app backed up into it, are way less likely then one of your passwords leaking.