2020-02-18 2026-05-15 Expert Review Tommy Pauly, David Schinazi identifier PvD ID FQDN String "pvd.example.com." expires Date after which this object is no longer valid Date "2020-05-23T06:00:00Z" prefixes Array of IPv6 prefixes valid for this PvD Array of strings ["2001:db8:1::/48", "2001:db8:4::/48"] dnsZones DNS zones searchable and accessible Array of strings ["example.com", "sub.example.com"] noInternet No Internet; set to "true" when the PvD is restricted. Boolean true splitDnsClaims Verifiable locally served domains Array of Objects [{ "resolver": "dns.example.net", "parent": "example.com", "subdomains": ["sub"], "algorithm": "SHA384", "salt": "abc...123" }] proxies Array of proxy dictionaries associated with this PvD Array of dictionaries [ { "protocol": "connect-udp", "proxy": "https://proxy.example.org/masque{?target_host,target_port}" } ] proxy-match Array of proxy match rules, as dictionaries, associated with entries in the proxies array. Array of dictionaries [ { "domains": [ "*.internal.example.org" ], "proxies": [ "default_proxy" ] } ] Standards Action See . Expert Review Tommy Pauly, Tirumaleswar Reddy.K, Benjamin M. Schwartz resolver The Authentication Domain Name String "dns.example.net" parent The parent zone name String "example.com" subdomains An array containing the claimed subdomains Array of Strings ["sub"] algorithm The hash algorithm String "SHA384" salt The salt (base64url) String "abc...123" Expert Review Unassigned protocol required The protocol used to communicate with the proxy String "connect-udp" proxy required String containing the URI template or host and port of the proxy, depending on the format defined by the protocol String "https://example.org:4443/masque/{?target_host,target_port}" mandatory optional An array of optional keys that client must understand and process to use this proxy Array of Strings ["example_key"] alpn optional An array of Application-Layer Protocol Negotiation protocol identifiers Array of Strings ["h3","h2"] identifier optional A string used to refer to the proxy, which can be referenced by other dictionaries, such as entries in proxy-match String "udp-proxy" Expert Review Unassigned socks5 host:port http-connect host:port Standard CONNECT method, using unencrypted HTTP to the proxy https-connect host:port Standard CONNECT method, using TLS-protected HTTP to the proxy connect-udp URI template connect-ip URI template connect-tcp URI template Expert Review Unassigned proxies No An array of strings that match identifier values from the top-level proxies array Array of Strings ["tcp-proxy", "udp-proxy"] domains Yes An array of FQDNs and wildcard DNS domains Array of Strings ["www.example.com", "*.internal.example.com"] subnets Yes An array of IPv4 and IPv6 addresses and subnets Array of Strings ["2001:db8::1", "192.0.2.0/24"] ports Yes An array of TCP and UDP port ranges Array of Strings ["80", "443", "1024-65535"]