Blanket ban rules are extremely lazy and unacceptable in 2026, especially for Fortune 500s. It’s extremely cheap to use a scoring system instead.

Really don't understand what "unacceptable" even means in this context. It is perfectly acceptable for a company to control internet access.

More to the point though, what is this cheap and easy domain scoring system that does a better job than a blanket ban?

The best domain reputation provider, DomainTools, definitely isn't providing their data for cheap, nor is it always the fastest. We pay a substantial amount to them for thousands of requests a day, something we reserve for enriching actual security incidents, not because someone wants to go to catparty.foobar or whatever.

Unacceptable for who? It's definitely more than acceptable for a lot of people.

Sure, but blanket bans are even cheaper.

You say this as if the people implementing TLD blocks even understand what the term scoring system means

They really aren't when you are operating at ISP scale. Especially when there are 20+ years of evidence of said scoring systems being abused until they calcified into the mess that is modern email hosting

> In general though, if you want Fortune 500s to utilize your service/company, don't utilize a novelty TLD.

New potential technique to not have your open source project yoinked/resold by cloud providers? :)

Would you consider .aero, .cat, .asia, .info novelties? They have been around for 20+ years. Sure, there are over 1500 gTLDs now, but when does something stop becoming a novelty? .ai a ccTLD, that Google recognizes as a gTLD, is that a novelty? These are a bit rhetorical.

I would define them by the bar to entry. When a spammer can pick up thousands of domains for a few hundred bucks or less because a dodgy registrar is intentionally selling all domains on a specific TLD for next to nothing I find it safe to block anything on that TLD. I have always done this for email both personally and professionally and never once received any push-back. I explained the risk of collateral damage and leadership was always fine with it. Customers were B2B and could log in to open a ticket. Customer emails would come from domains we already trusted in their on-boarding process.

I can't speak for the others, but registering a .aero domain requires submitting an application that's reviewed by a human and assessed based on the domain's relevancy to the aviation industry.