All of this would be still useless regarding the proposed attack concept, because [email protected] is also [email protected].

And domain aliasing is certainly out of scope of any email RFCs I saw. Netflix (and everyone else) may know about googlemail.com, but it's virtually impossible to know about all other cases.