I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) which required any user accounts to be an email address in the .name or possibly .me TLD (or in any other TLD that was intended for individuals or individual corporate employees only--i.e., not open to public registration) and perhaps disallowing subdomains (as it might be tempting for some companies to purchase a generic domain and lease out the personalized subdomains); of course it wouldn't stop a company from leasing out names like user123@spam-friendly-site.name, but as the TLD is intended for individuals, it would hopefully be easier to blacklist any such bad behavior-enabling sites wholesale.The purpose would be two-fold:Raise the threshold for spammers as they would have to either purchase a new domain any time they wanted a new spam account (and any abusing domains could be blacklisted and shared as a public list) or obtain control of a legitimate user's email account or browser/system.Encourage people to throw off the yoke of dependency on fixed third parties for emails as well as website hosting, chatting, etc. by getting their own domains. One wouldn't want a phone number like 555-123-1234@att.com because one could not freely change providers. And there are no doubt many would-be content creators who would share more freely if they had a site belonging to them. If one wanted to be anonymous, one could reserve domains like anonymous567.name (e.g., me@anonymous567.name) -- and this would be fine with me as my purpose is not to positively ID people outside of the context of confirming they control the email address they give me but to raise barriers to spammers. It would add a small price to do content creation on the site as users would have to purchase a domain and configure email on it and would cost more so to become truly anonymous (e.g., to purchase separate domains for each site to avoid tracking between sites), but I think the burden should not lie on content websites to deal with spam registrations.If this really gets going, one might also be able to set up one's email filters to block anyone not belonging to such a personalized domain as well, giving an auto-reply of how to register for one.Does anyone have feedback on the idea, specifically any unexpected barriers I might encounter (such as ways it could be circumvented)? I know of course that it will raise barriers for some users, but any potential technical challenges?
Possible holes in a spam-registration prevention approach?
security
I think you have already identified one flaw.  In general, web hosting providers have no interest in checking on the identity of their users, or of ensuring that they use domain names for legitimate purposes.  Indeed, use of domain names as a proxy identities is probably not covered by their terms of service ... and not of interest to them.In short, it won't be a significant impediment to spammers.The second problem is that most people who don't already have a domain name don't want to be bothered with it.  It costs money to get and keep a domain name.  It costs time to organize.  There is a learning curve. And so on.In short, it will be a significant impediment to a significant subset of your real users.And the other issue is that your scheme does not address your primary requirement ... authorization and access control.You asked about technical challenges.  Well my take is that the first problem above is a technical challenge.  Unless you insist on your users using specific hosting providers with specific procedures, your scheme provides no significant impediment to spammers.  All serious (professional) spammers have ways to get an unlimited number of throw-away DNS addresses for free.  So you are just going to be playing whack a mole at a different level.