This is a topic we think about a lot. The downside to requiring domain verification is additional friction, and if an external API call is required (e.g., logging in via Auth0), those tests may not be possible.

Accounts on the free tier won't be able to create much of an attack. We perform customer verification on accounts with higher concurrent virtual user limits.

We closely monitor potential abuse and will adjust our verification strategy as needed. Thanks for the question.