@techreport{jackson-csp-reporting-policy-00,
    number =    {draft-jackson-csp-reporting-policy-00},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-jackson-csp-reporting-policy/00/},
    author =    {Simon Jackson},
    title =     {{DNS-Published Content Security Policy Reporting Policy}},
    pagetotal = 16,
    year =      2026,
    month =     jun,
    day =       22,
    abstract =  {This document specifies a mechanism by which a domain operator can publish a Content Security Policy reporting endpoint policy in the Domain Name System. The mechanism allows user agents and reporting processors to discover one or more domain-authorised endpoints for receiving Content Security Policy violation reports, independently of the HTTP response that triggered the report. The mechanism is intended to improve administrative consistency across distributed web estates where the domain operator controls DNS but does not consistently control every web server, content management system, proxy, application stack, or hosting platform serving content beneath the domain. This document does not define DNS-based CSP enforcement. It defines only DNS-published reporting endpoint policy. User agents MUST NOT treat this mechanism as a replacement for the Content-Security-Policy or Content-Security-Policy-Report-Only HTTP response header fields.},
}