Use a different domain than the name in the record

Don't use hostmaster@example.com in example.com, use hostmaster@example.net instead. Even if all your other domains use @example.com addresses, it is then especially important that you never lose control over the admin access to example.com. It is worth provisioning a separate domain just for this purpose.