I need to allow users access to an application after verifying that they belong to the claimed institute through university email id. So that if a person claims that he belongs to Stanford University, he has verify that he posesses email account that ends with
...@stanford.edu. Sometimes department may have they own subdomain like ids may end with
...@cs.stanford.edu.The people that need to be allowed access to application could be faculty & students as well.
Is this a solid way of determining whether the person belongs to the claiming institute ? Any issues with this & how could this be made more better ?