Function check_email_domain 

pub(crate) fn check_email_domain(
    services: &Services,
    email_canon: &str,
) -> Result

Rejects a canonical email address whose domain is forbidden for new bindings.

Callers canonicalize the address before applying this add-time policy; password reset and existing bindings do not use it.