Authorize A / AAAA hosts (a) Authorize MX hosts (mx) IPv4 addresses / CIDRs IPv6 addresses / CIDRs Include domains Policy for everyone else (all)

Public key Accepted hash Testing mode (t=y) — receivers must not reject on failure Split into quoted 255-char strings (for BIND zone files)

Policy (p) Subdomain policy (sp) Aggregate report address (rua) Forensic report address (ruf) Apply to percent (pct) DKIM alignment (adkim) SPF alignment (aspf)

Max age (seconds) Include subdomains (includeSubDomains) Preload (preload)

Visibility No store (no-store) Revalidate every time (no-cache) Max age (seconds) Shared max age (s-maxage) Must revalidate (must-revalidate) Immutable (immutable)

default-src script-src style-src img-src connect-src font-src frame-src frame-ancestors Upgrade insecure requests (upgrade-insecure-requests)

Policy

geolocation camera microphone fullscreen payment autoplay

Username Password

Username Password Algorithm bcrypt cost (4–31, bcrypt only)

Preset Minute (0–59) Hour (0–23) Day of month (1–31) Month (1–12) Day of week (0–7, 0/7=Sun)

Flags (0, or 128 = critical) Tag Value (CA domain, or mailto:/URL for iodef)