Thanks for the explanation. Yeah, many domains being required probably is annoying / prohibitive enough to stop distributed botnet attacks.