AD2.1 refers. p20081216.1 addressed the overall email/domain issue fairly comprehensively. Two checks are required. As it stands at the moment, zero points accounts will not be able to issue certificates under the new roots because there is no system check. Assurance of a signed CAP form and at least one point stands in for a (second) check. OA is deferred.