checker: build owner FQDN from _domain subdomain label + apex

checker/collect.go

@@ -318,16 +318,19 @@ func defaultResolveHost(ctx context.Context, target string) (verdict, detail str
 
 // ownerFQDN returns the record owner FQDN, preferring the service's _domain field over subdomain+apex.
 func ownerFQDN(svcDomain, sub, apex string) string {
-	if svcDomain != "" {
-		return strings.TrimSuffix(svcDomain, ".")
+	fallback := func() string {
+		if apex == "" {
+			return sub
+		}
+		if sub == "" || sub == "@" {
+			return apex
+		}
+		return sub + "." + apex
 	}
-	if apex == "" {
-		return sub
+	if svcDomain == "" {
+		return fallback()
 	}
-	if sub == "" || sub == "@" {
-		return apex
-	}
-	return sub + "." + apex
+	return preferRRName(svcDomain, fallback(), apex)
 }
 
 // preferRRName returns the RR header Name as an FQDN when present.