Registrar: only for zones that are a registered domain

With porkbun.domains empty the Registrar tab was offered for every zone
and always failed for subdomain zones, reverse zones and private names.
dnsname.RegisteredDomain (public suffix list) now decides; the others
get a message naming what delegates them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_registrar.go

@@ -35,11 +35,16 @@ import (
 )
 
 // registrarFor names the registrar Jarl can manage z's delegation at:
-// "porkbun" when a key is configured and allows the zone's name.
+// "porkbun" when a key is configured and allows the zone's name, and the
+// zone is a registered domain (not a subdomain or a reverse zone, which
+// their parent zone delegates).
 func (s *Server) registrarFor(z *model.Zone) string {
 	if s.cfg.Porkbun == nil || z.Type != model.ZonePrimary {
 		return ""
 	}
+	if d, ok := dnsname.RegisteredDomain(z.Name); !ok || d != dnsname.Display(z.Name) {
+		return ""
+	}
 	if s.cfg.PorkbunAllows != nil && !s.cfg.PorkbunAllows(dnsname.Display(z.Name)) {
 		return ""
 	}
@@ -59,6 +64,16 @@ func (s *Server) registrarZone(r *http.Request, p *auth.Principal) (*model.State
 		return nil, nil, "", err
 	}
 	if s.registrarFor(z) == "" {
+		d, ok := dnsname.RegisteredDomain(z.Name)
+		switch {
+		case s.cfg.Porkbun == nil:
+		case dnsname.IsReverse(z.Name):
+			return nil, nil, "", badRequest("%s is a reverse zone: whoever holds the addresses (your ISP, or the RIR) delegates it, not a registrar. Check its delegation on the zone's Name servers tab (jarl zone delegation ZONE)", dnsname.Display(z.Name))
+		case !ok:
+			return nil, nil, "", badRequest("%s isn't a domain registered at a registrar (its suffix isn't a public one), so there is nothing to manage at Porkbun", dnsname.Display(z.Name))
+		case d != dnsname.Display(z.Name):
+			return nil, nil, "", badRequest("%s is a subdomain of %s: the NS (and DS) records in the zone %s delegate it, not the registrar. Manage %s at Porkbun instead", dnsname.Display(z.Name), d, d, d)
+		}
 		if s.cfg.Porkbun == nil {
 			return nil, nil, "", badRequest("no registrar is configured: add a Porkbun API key to jarl.yaml (porkbun:, see docs/dnssec.md#porkbun)")
 		}