I'm worried about user trust when their auth related email is not from the same domain as they are visiting.