A scam email used the name of a real, well known company. Should we block that company's domain?

Impersonating a legitimate business is a deliberate part of the con. A name you can actually look up gives the message instant credibility, because you search the company, find a real website and real reviews, and relax. The real company frequently has no idea it is being used this way.

That matters for how you respond. There is a strong instinct to block the domain of whoever appears to have contacted you, and it is usually the wrong move. If the brand is being impersonated, blanket blocking their domain does nothing to the attacker and quietly cuts you off from a real business you may need to hear from later. Those blocks tend to be forgotten and then cause a confusing problem months down the line.

Be precise instead. Block the exact sending address that contacted you. Block any unrelated domain that appeared when they replied, since that is often the attacker's actual infrastructure. Report the message as phishing in Outlook or Google Workspace so the filters learn from it. If it is worth the effort, the impersonated company usually has an abuse or security contact who would genuinely like to know.

One related check: confirm the message really was impersonation rather than a compromised mailbox at a company you actually do business with. Those look similar and are handled differently. If a real vendor's account has been taken over, the right move is to call that vendor on a number you already have and tell them, because their other customers are being targeted too.