SSO errors - some emails receive "Validation failed: Primary email is not allowed."

Is there anything common to the email addresses? Their length? Any symbols? Unicode characters?

If we can identify why they’re being rejected it should be possible to answer whether the rejection criteria in 2.3.9 has changed since.