Allowed email domains

My reading of the docs is that allowed email domains is checked against the email returned by OIDC during account creation. Can anyone confirm?