Get the effective domain synchronously: the live request's own domain, or DEFAULT_DOMAIN otherwise. A live request that has not seeded its domain yet reads DEFAULT_DOMAIN, never the fallback — the fallback names the site for out-of-request reporting, and one request's host must not answer another's security-header decision.