Why are nodes accessible on domains they are not published to?

There are three likely causes of this behavior.

1. The user is User 1 or can 'administer nodes'. These users can bypass node access rules by design. The solution is to enable 'Enforce Rules on Administrators' on the Domain Access settings page (Site Building -> Domains -> Settings). For more details see the Module Configuration page.
2. The node is assigned to 'all affiliates'. This displays the node on all sites by design. When 'all affiliates' is checked, the site-specific assignment is only used for editorial control and URL rewrites.
3. You are using more than one node access module. If any module grants access to a page it will be accessible.

If none of these solves you problem you can turn on debugging status, which will help you determine what is going on.

For more advanced troubleshooting, install the Devel and Devel Node Access modules and use the Devel Node Access block for debugging reports.