sender check: the reply names no other domain (L8); which key signs, tested (stage 2)

L8: a From: line naming another sender of the server was refused with
"it names another sender of this server, <domain>" - a confirmation, to
whoever tries names, that the domain is hosted here. The reason now stops
before the domain; the line as written stays in the reply (the client's own
text) and on the refused message's page (header_from). Unit test: the reason
of every refusal names none of the server's other domains; e2e: the reason
of each sender-check refusal does not contain other.e2e.test.

Which key OpenDKIM signs with (owner, 2026-10-13): the check and OpenDKIM
read From: with two parsers, and their agreement was argued, never run.
internal/milter/testdata/from-lines-passed.txt holds the lines the check
passes for an application - bare and bracketed, quoted names with a comma,
escaped quotes and an address inside, an extension, three encoded charsets,
two folded lines, comments (nested too), a stranger's address in the name -
as Go-quoted strings with {domain}. The unit test wants each passed; the new
e2e case passed_from_lines_signed_for_their_domain_only sends each as app1
and wants every DKIM signature at the sink to be for the sender domain,
with one valid. All fifteen were. "(the shop) a@domain" - a comment before
the address, valid RFC 5322 - is refused by the check ("it must be one
address"); strict, not a hole, so it is not in the file. Groups are refused
too.

Audit plan lines ticked (two) with what was found, CHANGELOG [Unreleased],
roadmap 21/62.
Evidence on the test server for this tree (with a618ffb): go vet clean, go
test ./... 23 packages ok, make e2e exit 0 - the new case passed in 4 s.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/sender_test.go

@@ -3,6 +3,7 @@ package milter
 import (
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -144,6 +145,14 @@ func TestSenderCheck(t *testing.T) {
 			if !strings.HasPrefix(text, "y 550 5.7.1 From: ") || !strings.Contains(text, c.wantText) {
 				t.Fatalf("reply %q, want a 550 5.7.1 saying %q", text, c.wantText)
 			}
+			// The reason names no other domain of the server (audit L8); the
+			// From: line before it is what the client wrote itself.
+			reason := text[strings.LastIndex(text, " - ")+3:]
+			for _, other := range []string{"example.com", "mail.example.org", "example.org"} {
+				if strings.Contains(reason, other) {
+					t.Fatalf("the reason %q names %s", reason, other)
+				}
+			}
 			if len(rows) != 1 || rows[0].Reason != store.ReasonFrom || rows[0].To != "someone@elsewhere.example" || rows[0].AppLogin != c.login {
 				t.Fatalf("log rows: %+v", rows)
 			}
@@ -271,3 +280,37 @@ func TestSenderCheckRefusalWithNullSenderHasItsDomain(t *testing.T) {
 		}
 	}
 }
+
+// passedFromLines reads testdata/from-lines-passed.txt with {domain} put in.
+func passedFromLines(t *testing.T, domain string) []string {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("testdata", "from-lines-passed.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var out []string
+	for _, line := range strings.Split(string(raw), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		s, err := strconv.Unquote(line)
+		if err != nil {
+			t.Fatalf("%s: %v", line, err)
+		}
+		out = append(out, strings.ReplaceAll(s, "{domain}", domain))
+	}
+	return out
+}
+
+// Every line of the shared file is passed for the domain's application; the
+// e2e then checks OpenDKIM signs each for that domain alone.
+func TestSenderCheckPassesTheSharedLines(t *testing.T) {
+	bind := NewBindings(writeMaps(t, senderMaps))
+	for _, line := range passedFromLines(t, "shop.example.org") {
+		resp, rows := offer(t, bind, "shop", "shop@shop.example.org", [2]string{"From", line})
+		if resp != milter.RespContinue || len(rows) != 0 {
+			t.Errorf("From: %q refused: %s", line, replyText(resp))
+		}
+	}
+}