This is why I used the expression "problematic but fixable". There are issues, sure, but as another commenter pointed out, they're easier to trace, and these are problems that can be fixed. Meanwhile, domain validation is only peripherally better than "no validation at all".

Unfortunately, the only meaningful form of identity confirmation we have is being railroaded away using one-off examples of imperfections that can be fixed fairly trivially, and which have never been effectively used maliciously.