I'm thinking of a system where only users who have email with domain
empresa.com can register. After registration an email will be sent to the email validation.
So far so good, I can easily check the email domain when the user is registering.
Let's also assume that the person responsible for distributing the emails from the
empresa.com domain has full control of all active emails.
Now my question is, is there a security breach that could allow users with other domains to sign up, or to mask their email?
Is there any possibility that DNS poisoning could affect the security of this system?
Please note that the question is not related to how to implement, but what are the possible security holes or attacks that I may experience in an attempt to circumvent email domain verification.