checker: build owner FQDN from subdomain + apex at service scope

checker/collect.go

@@ -57,19 +57,24 @@ func (p *aliasProvider) Collect(ctx context.Context, opts sdk.CheckerOptions) (a
 // resolveOwner prefers the "service" option because its dns.CNAME owner is
 // authoritative; subdomain + domain_name is the fallback for ad-hoc forms.
 func resolveOwner(opts sdk.CheckerOptions) (string, error) {
+	parent, _ := sdk.GetOption[string](opts, "domain_name")
+	parent = strings.TrimSuffix(parent, ".")
+
 	if svcMsg, ok := sdk.GetOption[serviceMessage](opts, "service"); ok && len(svcMsg.Service) > 0 {
 		var c cnameService
-		if err := json.Unmarshal(svcMsg.Service, &c); err == nil && c.Record != nil && c.Record.Hdr.Name != "" {
-			return lowerFQDN(c.Record.Hdr.Name), nil
+		if err := json.Unmarshal(svcMsg.Service, &c); err == nil && c.Record != nil {
+			// svcMsg.Domain holds the subdomain (relative to apex); the
+			// record's Hdr.Name is relative to that mount point. Build the
+			// origin first, then join the record name into it.
+			origin := sdk.JoinRelative(strings.TrimSuffix(svcMsg.Domain, "."), parent)
+			return lowerFQDN(sdk.JoinRelative(c.Record.Hdr.Name, origin)), nil
 		}
 	}
 
-	parent, _ := sdk.GetOption[string](opts, "domain_name")
 	sub, _ := sdk.GetOption[string](opts, "subdomain")
 	if parent == "" {
 		return "", fmt.Errorf("missing 'domain_name' option")
 	}
-	parent = strings.TrimSuffix(parent, ".")
 	if sub == "" || sub == "@" {
 		return lowerFQDN(parent), nil
 	}

checker/definition.go

@@ -17,8 +17,6 @@ func Definition() *sdk.CheckerDefinition {
 		Version: Version,
 		Availability: sdk.CheckerAvailability{
 			ApplyToService: true,
-			ApplyToDomain:  true,
-			ApplyToZone:    true,
 			LimitToServices: []string{
 				"svcs.CNAME",
 				"svcs.SpecialCNAME",
@@ -65,6 +63,11 @@ func Definition() *sdk.CheckerDefinition {
 					Label:    "Service",
 					AutoFill: sdk.AutoFillService,
 				},
+				{
+					Id:       "domain_name",
+					Label:    "Parent domain name",
+					AutoFill: sdk.AutoFillDomainName,
+				},
 			},
 		},
 		Rules: []sdk.CheckRule{