Another nice thing about having a catch-all on own domain is that you can sign up to each service with a unique email address, e.g. <microsoft>@<your-domain.com>, which makes it easy to see if any services ever sold your address.
Let’s note however that even "owning a domain" is an illusion of control, as IANA is ultimately a retainer of uncle Sam. I don’t know if there is any functional distributed alternative that promote more autonomy to end users that can works out of the box (or even just a few basic install steps away) in most digital terminal out there.
https://www.zdnet.com/home-and-office/networking/icann-still...
That’s not true. It’s definitely not complete control, but it’s far more “sovereign” and independent than having a user account with some corporation that can change its ToS overnight. To seize a domain, a lengthy legal process is needed. Not to mention, you can choose a domain that doesn’t fall under a specific country’s jurisdiction or choose a registrar company located in another country. For example, you can register a domain like .ch or .no, and a legal US order won’t be effective, especially if you didn’t use a US-based registrar. Furthermore, you can host your own domain name (1). It isn’t entirely safe, but the process and efforts to seize it are far more complicated than a click in an MS dashboard. Unless that person is doing something extremely illegal, no one will bother.
(1) https://blog.technitium.com/2022/06/how-to-self-host-your-ow...
Pro tip on this, use gibberish if you want a true canary. I know it's tempting to use microsoft@ or ms@ or msft@ etc, but companies are getting smarter about selling emails and filter those out.
This is true when services support sign-up with a password and you are an advanced user. I'm not sure that this is easy for many vulnerable people that need this. The advice you may need to add is that you should use these unique email addresses to create burner accounts on login providers (Microsoft accounts, Google accounts, etc.) because that's how you have to access some services.
You don't need your own domain for that. Gmail (and probably the other big ones) support it as well, just add a plus sign and whatever after your username: username+microsoft@gmail.com will end up in the inbox of username@gmail.com.