Apply subdomain coverage without confusing policy ownership

A child cannot cancel an active parent policy; deleting a parent does not erase a child’s separate policy.

• The browser compares already IDNA-canonicalized domain labels using ASCII case-insensitive matching. IDNA means Internationalized Domain Names for Applications; its validation and conversion occur before these rules. Raw Unicode case conversion is not a substitute.
• An exact known host match applies regardless of its includeSubDomains flag. A parent-domain match applies to descendants only when that parent’s includeSubDomains flag is set. A host cannot set policy for its parent or sibling merely by sending its own header.
• Matching is label-by-label, not an arbitrary text suffix: badexample.com and example.com.evil.test are not descendants of example.com. shop.example.com is a descendant; policies do not require a DNS lookup to test this relationship.
• A child receiving max-age=0 deletes only its own record. An unexpired ancestor’s includeSubDomains policy still applies. Conversely, deleting an ancestor’s record leaves separately learned child records intact.
• Administrators need to consider every covered HTTP service, including alternate ports and descendants that cannot serve valid HTTPS. Merely intending a parent policy is insufficient if the browser never receives it; each common entry point should advertise its own policy (non-normative §11.4).