I feel sad that what I think of as the obvious solution, companies using subdomains like internal.microsoft.com instead of making a million different domains, is so far from happening that no one here on HN has even brought it up.
You are correct.
Reminds me, we once got a letter by a German government body requesting some data exports from our company, and to upload them on findrive-ni.de
It turned out to be legit, but it's neither a subdomain of the state of Niedersachsen domain nor referenced in their official sites.
[dead]
Hell, they have .microsoft. Why'd they bother?