I think that might be the point; it would create a headache for the company and its users and when they do the retrospective they'll find that use of unverifiab

I think that might be the point; it would create a headache for the company and its users and when they do the retrospective they'll find that use of unverifiable domains was the mistake. Or using the vendor who uses them was the mistake. Filtering that catches "false positives" which are indiscernible from phishing is 10x more likely to curb this practice than trying to educate anyone about the problem.