dmarc: no custom report address on the server's own name (audit W1)

Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.

Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.

Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.

Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_dmarc.go

@@ -44,6 +44,14 @@ func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
 			refuse(http.StatusBadRequest, "Enter the report address or choose another option.")
 			return
 		}
+		// An address on the server's own name is a mailbox of this server:
+		// the one way to one is the hosted choice, which is tagged with this
+		// domain. A typed one opened an untagged mailbox - or another
+		// domain's - to the whole internet (security audit 2026-10-17, W1).
+		if dmarc.IsHostedOnHostname(email, h.cfg.Hostname) {
+			refuse(http.StatusBadRequest, "That address is on this server's own name. To have SelfPost receive the reports, choose SelfPost hosted.")
+			return
+		}
 		rua = email
 	case ruaHosted:
 		if h.dmarc == nil || !h.dmarc.Enabled() {

internal/web/handlers/handlers_dmarc_test.go

@@ -356,3 +356,23 @@ func TestDeleteDomainSaysItIsGoneWhenARebuildFails(t *testing.T) {
 		t.Errorf("the domain is still there: %v", err)
 	}
 }
+
+// A typed report address on the server's own name is refused: the hosted
+// choice is the one way to a mailbox here, tagged with the domain - a typed
+// one opened an untagged mailbox, or another domain's, to the internet
+// (security audit 2026-10-17, W1).
+func TestCustomReportAddressOnTheHostnameIsRefused(t *testing.T) {
+	s, _ := hostedStand(t)
+	for _, addr := range []string{"ops@mail.example.org", "dmarc-reports+victim.example@MAIL.example.org", hostedForExample} {
+		rec := s.saveReports(url.Values{"dmarc_rua_mode": {"custom"}, "dmarc_rua_email": {addr}})
+		if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "choose SelfPost hosted") {
+			t.Errorf("custom %s = %d:\n%.600s", addr, rec.Code, rec.Body.String())
+		}
+		if got := s.reportAddress(t); got != "" {
+			t.Errorf("custom %s stored %q", addr, got)
+		}
+	}
+	if rec := s.saveReports(url.Values{"dmarc_rua_mode": {"custom"}, "dmarc_rua_email": {"reports@hub.example"}}); rec.Code != http.StatusSeeOther {
+		t.Errorf("an address elsewhere = %d", rec.Code)
+	}
+}