> Even then, that wouldn't really stand out to me because I've seen companies use new generic top level domains to separate out things like the blog at .blog or the docs at .guide, not to mention the .new stack.

This is very much a 'can we please not' situation, isn't it? (Obviously it's not something that the email recipients can (usually) control, so it's not a criticism of them.) It also has to meaningfully increase the chance that someone will eventually forget to renew a domain, too.

Facebook sends legit account secuirty emails from facebookmail.com. Horrible.

Anecdotally throughout all this, contacting npm got me a response from githubsupport.com. I had to double check if that was even real.