panel-redesign: no report mailbox for the server as a whole

Follows the design commit before it.

  - internal/dmarc: the ingest allow-list is the report address of each
    domain that is on this host and nothing else;
    DefaultHostedReportAddress and DefaultHostedSuggestion are removed.
    Since 1.7.0 the general mailbox dmarc-reports@<hostname> was open
    while no panel-wide default existed; the three-choice scheme had
    left it open always.
  - The DMARC hub's Ingest box shows the form of a hosted address,
    dmarc-reports+<domain>@<hostname>.
  - guide.md: what port 25 accepts.

Evidence: docs/assets/panel-redesign/evidence/dmarc.png re-shot (the
address form wraps after the plus sign in its column at 1440 px).

  go test -count=1 ./internal/dmarc/... ./internal/web/... ./cmd/panel: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/addresses.go

@@ -4,7 +4,8 @@ import (
 	"strings"
 )
 
-// DefaultLocalPart is the mailbox local-part for the panel-wide hosted address.
+// DefaultLocalPart is the local part of every hosted address; the domain
+// follows it after a plus sign.
 const DefaultLocalPart = "dmarc-reports"
 
 // HostedReportAddress is the per-domain SelfPost-hosted rua= destination.
@@ -14,11 +15,6 @@ func HostedReportAddress(hostname, domain string) string {
 	return DefaultLocalPart + "+" + domain + "@" + hostname
 }
 
-// DefaultHostedReportAddress is the settings-level hosted rua= when ingest is on.
-func DefaultHostedReportAddress(hostname string) string {
-	return DefaultLocalPart + "@" + strings.ToLower(strings.TrimSpace(hostname))
-}
-
 // IsHostedOnHostname reports whether addr is delivered locally on hostname.
 func IsHostedOnHostname(addr, hostname string) bool {
 	addr = strings.ToLower(strings.TrimSpace(addr))

internal/dmarc/service.go

@@ -64,10 +64,9 @@ func (s *Service) AllowedRecipients() ([]string, error) {
 		seen[addr] = true
 		out = append(out, addr)
 	}
-	// The instance's generic mailbox is always open: it is the address the
-	// guide tells a fresh install to publish. A domain's own report address
-	// opens the mailbox it names, if that is on this host.
-	add(DefaultHostedReportAddress(s.hostname))
+	// Only what a domain has chosen is open: its report address opens the
+	// mailbox it names, if that is on this host. There is no mailbox for the
+	// server as a whole.
 	domains, err := s.store.ListDomains()
 	if err != nil {
 		return nil, err
@@ -101,11 +100,6 @@ func (s *Service) HostedSuggestion(domain string) string {
 	return HostedReportAddress(s.hostname, domain)
 }
 
-// DefaultHostedSuggestion is the settings-level hosted address.
-func (s *Service) DefaultHostedSuggestion() string {
-	return DefaultHostedReportAddress(s.hostname)
-}
-
 // ValidateHostedAddress ensures addr is on this hostname before saving.
 func (s *Service) ValidateHostedAddress(addr string) error {
 	if !IsHostedOnHostname(addr, s.hostname) {

internal/dmarc/service_test.go

@@ -7,8 +7,8 @@ import (
 	"github.com/mixeme/selfpost/internal/store"
 )
 
-// The ingest allow-list is the generic mailbox plus the report address of each
-// domain that points at this host: a new domain (no reports) and a domain
+// The ingest allow-list is the report address of each domain that points at
+// this host, and nothing for the server as a whole: a new domain (no reports) and a domain
 // reporting to another host open nothing of their own.
 func TestAllowedRecipientsFollowTheDomainAddresses(t *testing.T) {
 	st, err := store.Open(t.TempDir() + "/test.db")
@@ -36,7 +36,7 @@ func TestAllowedRecipientsFollowTheDomainAddresses(t *testing.T) {
 	if err != nil {
 		t.Fatalf("AllowedRecipients: %v", err)
 	}
-	want := []string{"dmarc-reports+hosted.example@mail.example.com", "dmarc-reports@mail.example.com", "ops@mail.example.com"}
+	want := []string{"dmarc-reports+hosted.example@mail.example.com", "ops@mail.example.com"}
 	if !reflect.DeepEqual(got, want) {
 		t.Errorf("allowed recipients = %v, want %v", got, want)
 	}