banks also often have multiple domains - different one for transactional emails, different one for statements etc.

Instead of auto-locking it should be possible as user to configure the list of allowed domains that land there.