Not necessary. It’s an internet 101 risk, which has been taken advantage of for decades. I’m confident in my risk assessment that domain-based verification is still susceptible to easy spoofing with mis-spelled domains and alternate TLDs. No need to look at the protocol.