This reminds me: I've noticed that Starbucks now requires a few pieces of information to use their WiFi network. One is email and they are doing some sort of validation which will reject emails like whoopsileanedonxxxxxxxx@aol.com but will accept other, legit AOL emails. How are they deciding what is/not a valid email? Are they using a compiled list of emails that have been seen in the wild? What if it's a brand new address, though? Presumably AOL isn't exposing a service for them to use in realtime. I haven't tested this extensively or with other providers.

It's obvious that they care (to some extent) that they're getting valid emails, so why not use a basic regex on the FE and an OTP which gets sent to the provided address?