this is the python code that figures out the domain:
`
self.facts['fqdn'] = socket.getfqdn()
...
self.facts['domain'] = '.'.join(self.facts['fqdn'].split('.')[1:])
`
^ basically splits from fqdn after the first . , so "www.example.com"
would return "example.com"
It was an ordering issue within the /etc/hosts file.
I have some local aliasing setup as an artifact of legacy systems, and socket.getfqdn resolves these in order, where ansible grabs the first element for ansible_fqdn and ansible_domain.