You'd think that they'd have a non-domain-based way to do it, like cryptographically signing their own damn emails with a key embedded in outlook or something.