If you use a public domain that you don't own then I can trick your employees into sending me their credentials!! I'll know what company the request came from, so I will know where to use those credentials to attack you.