As another commenter pointed out, the list of domains the header is sent to is part of the Chromium codebase: https://chromium.googlesource.com/chromium/src/+/master/comp...