sender check: the reply names no other domain (L8); which key signs, tested (stage 2)

L8: a From: line naming another sender of the server was refused with
"it names another sender of this server, <domain>" - a confirmation, to
whoever tries names, that the domain is hosted here. The reason now stops
before the domain; the line as written stays in the reply (the client's own
text) and on the refused message's page (header_from). Unit test: the reason
of every refusal names none of the server's other domains; e2e: the reason
of each sender-check refusal does not contain other.e2e.test.

Which key OpenDKIM signs with (owner, 2026-10-13): the check and OpenDKIM
read From: with two parsers, and their agreement was argued, never run.
internal/milter/testdata/from-lines-passed.txt holds the lines the check
passes for an application - bare and bracketed, quoted names with a comma,
escaped quotes and an address inside, an extension, three encoded charsets,
two folded lines, comments (nested too), a stranger's address in the name -
as Go-quoted strings with {domain}. The unit test wants each passed; the new
e2e case passed_from_lines_signed_for_their_domain_only sends each as app1
and wants every DKIM signature at the sink to be for the sender domain,
with one valid. All fifteen were. "(the shop) a@domain" - a comment before
the address, valid RFC 5322 - is refused by the check ("it must be one
address"); strict, not a hole, so it is not in the file. Groups are refused
too.

Audit plan lines ticked (two) with what was found, CHANGELOG [Unreleased],
roadmap 21/62.
Evidence on the test server for this tree (with a618ffb): go vet clean, go
test ./... 23 packages ok, make e2e exit 0 - the new case passed in 4 s.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -690,7 +690,7 @@ has already run is never edited — the next file is added; the published
    about the name in DNS, and whoever holds the name now is its reader.
 - [ ] Docs: security.md § Roles (the guard) and the struck accepted risk, guide
    § Domain export, schema-migrations.md. — **Sonnet**
-- [ ] **Which key OpenDKIM signs with, seen and not reasoned** (owner,
+- [x] **Which key OpenDKIM signs with, seen and not reasoned** (owner,
    2026-10-13, from the Not verified list of from-header-binding). The check
    and OpenDKIM read `From:` with two parsers; that they agree was argued
    from the check's two rules, never run. An e2e case sends, as one
@@ -701,7 +701,12 @@ has already run is never edited — the next file is added; the published
    shared with the check's unit test, so a line added to one is run by the
    other. A disagreement found is fixed in the check before the cut, and
    security.md § Mail path says the claim is tested. - **Opus**
-- [ ] **The 550 reply names no other domain** (L8): `sender.go:334` stops at
+   *Done 2026-10-14:* fifteen lines (`internal/milter/testdata/from-lines-passed.txt`),
+   each signed for the application's domain alone, the signature valid. No
+   disagreement. Groups are refused by the check, so none is in the file;
+   a comment before the address - `(the shop) a@domain`, valid RFC 5322 - is
+   refused too ("it must be one address"): strict, not a hole, left as it is.
+- [x] **The 550 reply names no other domain** (L8): `sender.go:334` stops at
    "it names another sender of this server"; the refused message's page
    still shows the `From:` line as written (`header_from`), so the operator
    loses nothing. Test pins the reply text; e2e's sender-check negatives