> or IP range

The exact issue I explained - for you it would be a local IP, even if the actual destination is anywhere else => no checks.

> TLD is what matters

   bankofamerica.com.lan

It can't be used in the wild, compared to bankofamerica.com.security.itdept.xyz in the email, but it opens a way for a directed attacks to be way easier. Especially considering the awful security record of most 'SOHO' routers out there.

Sure, you can respond with evil bit set to zero for IoT devices...