So we use the freebie domain doppelganger tool from Knowbe4, and create a dictionary form the results of any domain that's registered.
We then block any mail matches that dictionary using a content filter.
When esa 15.x releases, I'll use a script to run dnstwist to update the dictionary via API instead of manually.
