Domain, sub-domain, either works. Mastodon and indeed ActivityPub do not solve the spam problem. I think they were counting on rate limiting of user creation,

Domain, sub-domain, either works. Mastodon and indeed ActivityPub do not solve the spam problem. I think they were counting on rate limiting of user creation, and blocks of servers to solve it. However I have shown there is no rate limit on users, and blocks can be circumvented with a simple domain switch, or subdomain in many cases. In short the current solutions do not scale. My guess is the best option at this point is a proof of work system similar to bitmessage or what Microsoft proposed for email. Turn this on for any unsolicited request could solve it, or make it so expensive that its no longer worth it. Other option would be to use the public/private keys that are required for signing for encryption as well. That would slow spammers down a bit.