In the spec, it's per domain. As implemented in Chrome/Safari/IE, it's per subdomain.