dmarc-ingest: Postfix can run the command, and it is told the recipient

The first DMARC report to reach the test server (Google, 2026-10-11
09:41 UTC) was accepted on port 25 and then sat in the queue:

  postfix/pipe: fatal: missing user= command-line attribute
  postfix/qmgr: warning: private/dmarc-ingest socket: malformed response

Three things stood between an accepted report and the panel, all since
the feature shipped in 1.7.0 - no report had ever been delivered:

- The service was addressed as dmarc-ingest/unix-pipe. Its type is unix:
  postconf -P answered "unmatched service_name/type" for flags=, user=
  and argv= (the warnings in the container log at every start), which
  are arguments of pipe(8) anyway and not -o parameters, and the service
  stayed a bare "pipe". For the same reason postconf -MX never removed
  it. It is dmarc-ingest/unix now, with the arguments in the service line.
- pipe(8) gives the command export_environment and nothing else, so the
  command would have refused to run: it reads DMARC_REPORTS_ENABLE (and
  the data directory, when it is not the default) from the environment.
  Those are now named in export_environment.
- The command took the recipient from RECIPIENT, which local(8) sets and
  pipe(8) does not. With no recipient the check that a report came to the
  address of its own domain is skipped. It is now ${recipient} in argv,
  one recipient per run.

When DMARC ingest is off the service and both parameters are removed.

e2e: every port-25 combination now asks Postfix for the service and the
two parameters (postconf -M / -h), and for their absence when ingest is
off - which is how the wrong type was found. make e2e on the test
server: ok. go test ./cmd/panel/ ./internal/dmarc/ ./internal/postfix/:
ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/dmarc_ingest.go

@@ -26,10 +26,7 @@ func runDMARCIngestMode() error {
 	}
 	defer st.Close()
 
-	recipient := strings.ToLower(strings.TrimSpace(os.Getenv("RECIPIENT")))
-	if recipient == "" {
-		recipient = strings.ToLower(strings.TrimSpace(os.Getenv("ORIGINAL_RECIPIENT")))
-	}
+	recipient := ingestRecipient(os.Args[1:])
 	if err := dmarc.IngestMessage(st, io.LimitReader(os.Stdin, maxIngestStdin), recipient, time.Now().UTC()); err != nil {
 		if incrErr := st.IncrDMARCParseFailures(); incrErr != nil {
 			log.Printf("dmarc ingest: record failure: %v", incrErr)
@@ -39,6 +36,21 @@ func runDMARCIngestMode() error {
 	return nil
 }
 
+// ingestRecipient is the report address the message was delivered to. Postfix's
+// pipe(8) hands it over as an argument (${recipient} in the service's argv,
+// build/postfix-config.sh) - it sets no RECIPIENT variable, that is local(8).
+// Without it the check that a report came to its own domain's address is
+// skipped.
+func ingestRecipient(args []string) string {
+	for _, a := range args {
+		if a == "-dmarc-ingest" {
+			continue
+		}
+		return strings.ToLower(strings.TrimSpace(a))
+	}
+	return ""
+}
+
 func isDMARCIngestInvocation() bool {
 	if len(os.Args) > 1 && os.Args[1] == "-dmarc-ingest" {
 		return true