They got the .microsoft TLD a while back specifically for this purpose. Supposedly they want to migrate all their cloud services there, but I learned about that a year ago and I’ve only seen it in use once since (IIRC on Loop…)

And let’s not forget about facebookmail.com, the official mail server for Facebook login notifications since 2004.

The tech is here, the risks are enormous, but the corpos don’t care because they don’t bear the costs of phishing attacks and governments are too impotent to enforce minimum standards of cybersecurity.