Nice blog post. I made a similar switch, but in the back of my mind I worry that I’ve introduced a new risk factor, since it’s much more likely for my custom domain to get hijacked than gmail.com.

See for example this story of someone’s Twitter account getting stolen via a social engineering attack on their registrar: https://arstechnica.com/information-technology/2014/01/picki...

A Google search suggests that setting up a registry lock could be an additional layer of defense against these types of attacks.

Have you done anything to guard against this type of attack?