PERMISSIVE

Fail open for unregistered domains: registered domains are still pinned, but unregistered domains are allowed through. Intended for development, staging, and gradual rollout to STRICT.