Easiest approach is for these companies to add a TXT data with a public key on their website domain that matches the one being used here. This way places like iris can verify that they are the owners of that account.
Discussion
I actually really like this, except the fact that companies would just add their own NIP-05 to their own domain before editing DNS records to make a third-party NIP-05 work.