dmarc: no custom report address on the server's own name (audit W1)

Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.

Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.

Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.

Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -1343,7 +1343,8 @@ settings) and nowhere else:
   server whose reports are parsed and shown under *DMARC reports*. Offered only
   while `DMARC_REPORTS_ENABLE=true`.
 - **A specific address** — any mailbox, typed for this domain; it receives the
-  raw XML. Beside the field, *Use my e-mail* fills it with the e-mail of your
+  raw XML. Not one on `SELFPOST_HOSTNAME`: to have this server receive the
+  reports, choose *SelfPost hosted*. Beside the field, *Use my e-mail* fills it with the e-mail of your
   profile (Account); it only fills the field, and saving is the form's own
   button. The button is absent when your profile has no e-mail.
 
@@ -1351,8 +1352,8 @@ Changing the choice changes the DMARC record to publish; the domain page shows
 the new value. There is no panel-wide or per-user default. Only addresses on
 `SELFPOST_HOSTNAME` that a domain has chosen are accepted on port 25 - the
 hosted address `dmarc-reports+<domain>@<hostname>` of a domain set to
-*SelfPost hosted*, or a typed address that happens to be on this host. There
-is no mailbox for the server as a whole.
+*SelfPost hosted* - and a report is kept only when it is for the domain the
+address is tagged with. There is no mailbox for the server as a whole.
 
 **DNS.** Publish the usual `_dmarc` TXT on each sending domain with
 `rua=mailto:…` pointing at the address the domain shows. Receivers deliver to the

docs/security-audit-2026-10-17.md

@@ -737,11 +737,14 @@ the argument.
   into the store (`countInboundWrites`, both writers),
   `InsertInboundSpamMessage`; TestInboundRecipientRepeatedIsOneRow,
   TestInboundJournalIsCutWhicheverWriterWrites.
-- [ ] **W1.** Refuse a custom report address on the hostname; exact hosted
+- [x] **W1.** Refuse a custom report address on the hostname; exact hosted
   address only in `AllowedRecipients`; a tag required for every recipient on
   the hostname in `checkReportDomain`; the existing test inverted; the
   accepted-risk text corrected. Check the live registry for a custom address
-  on the hostname first (none expected). — **Opus**, 1.5 h.
+  on the hostname first (none expected). — **Opus**, 1.5 h. *Done
+  2026-10-17:* the live registry holds two hosted addresses and no custom
+  one on the hostname; TestCustomReportAddressOnTheHostnameIsRefused, the
+  untagged cases in TestIngestMessageRejectsTagMismatch.
 - [ ] **A5/W2.** Delete a domain's reports in `domain.Service.Delete` (the
   cheap form); security.md § Roles says reports go with the domain. —
   **Sonnet**, 0.5 h. (The `domain_id` form is better and 2 h; take it if

docs/security.md

@@ -636,10 +636,16 @@ deferred item from the roadmap.
   the alignment statistics the panel shows. Inherent to how `rua` works:
   reporters are arbitrary third parties and the mailbox address is published in
   DNS. The ingest already constrains the meaningful part — a report cannot be
-  filed under a domain this instance does not host, and the claimed domain is
-  cross-checked against the `+tag` of the delivery address (effective since
-  2.0.0: before it the recipient never reached the command) — and the data is
-  advisory statistics only; nothing enforces off it. What a stranger can do is
+  filed under a domain this instance does not host, and the claimed domain
+  must be the `+tag` of the delivery address (checked since 2.0.0: before it
+  the recipient never reached the command; required since `2.14.4`) — and
+  the data is advisory statistics only; nothing enforces off it. The only
+  mailboxes are the hosted addresses, each open while its own domain has
+  chosen it: a typed report address on the server's own name is refused, and
+  one stored before is no mailbox (until `2.14.4` a domain user could type
+  `ops@<hostname>` and so open an untagged mailbox to the internet whose
+  reports were filed under any domain, or another domain's hosted address -
+  security audit 2026-10-17, W1). What a stranger can do is
   limited to a domain that chose a SelfPost-hosted address, through that
   address: file reports under it, replace one whose reporter and id they know,
   and fill that domain's 500 — not another domain's. A message that is not a