Found an email spoofer..
Has a few domains to select from.. Email is in the CLEAR if someone else knows the 'boxname', but if you don't want to use personal account. (I have no affiliation with the domain.)
If used, be sure to make a record of user/domain for the initial verification & for password reset validation.
https://www.sharklasers.com