I'm very surprised Apple doesn't enforce the reverse-DNS nature of these IDs and allow all sorts of jumbled strings, let alone not verifying that your in fact own the domain.