i think its finished

app/routes.py

@@ -1,7 +1,7 @@
 from flask import Blueprint, render_template, request, flash, redirect, url_for, current_app
 from flask_mail import Message
 from itsdangerous import URLSafeTimedSerializer, SignatureExpired, BadSignature
-from app.extensions import db, mail
+from app.extensions import db, mail, limiter
 from app.models import Participant
 
 bp = Blueprint('main', __name__)
@@ -37,6 +37,7 @@ def send_waitlist_email(user):
     mail.send(msg)
 
 @bp.route('/', methods=['GET', 'POST'])
+@limiter.limit("5 per hour", methods=["POST"])
 def index():
     confirmed_count = get_confirmed_count()
     max_spots = current_app.config['MAX_SPOTS']
@@ -47,11 +48,11 @@ def index():
         email = request.form['email'].lower().strip()
         looking_for_team = True if request.form.get('looking_for_team') else False
         
-        tum_domain = current_app.config['TUM_DOMAIN']
-        if not email.endswith(f"@{tum_domain}"):
-            flash(f"Error: You must use a @{tum_domain} email address.", "error")
+        tum_domains = current_app.config['TUM_DOMAINS']
+        if not email.endswith(tum_domains):
+            domains_str = ", ".join(tum_domains)
+            flash(f"Error: You must use one of these email addresses: {domains_str}", "error")
             return redirect(url_for('main.index'))
-
         existing_user = Participant.query.filter_by(email=email).first()
 
         if existing_user:
@@ -81,7 +82,9 @@ def index():
 
     return render_template('index.html', spots_left=spots_left, max_spots=max_spots)
 
+
 @bp.route('/verify/<token>')
+@limiter.limit("50 per hour")
 def verify_email(token):
     s = URLSafeTimedSerializer(current_app.config['SECRET_KEY'])
     try:
@@ -108,13 +111,16 @@ def verify_email(token):
     return render_template('success.html', message=msg, discord_link=discord_link, discord_token=discord_token)
 
 @bp.route('/dsgvo')
+@limiter.exempt
 def dsgvo():
     return render_template('dsgvo.html')
 
 @bp.route('/impressum')
+@limiter.exempt
 def impressum():
     return render_template('impressum.html')
 
 @bp.route('/rules')
+@limiter.exempt
 def rules():
     return render_template('rules.html')