The best answer I have discovered so far, in the hope that it will help someone else:
As far as I can tell, the key issue is whether the CSS file (and not the font file) is uploaded cross-domain. If I load a CSS file with @ font-face declarations from my static asset domain, I wonβt do anything to make the fonts work in FF or IE, regardless of the access control headers. If I download a CSS file from the same domain as the page, or just transfer the @ font-face declarations to the style block in the page header, then it works in all browsers (I can even load cross-domain font files as long as I have a set access control headers).
To summarize: AFAICT, FF 3.5, and IE 8 will abandon the @ font-face name of the declarations in the cross-domain CSS file, no matter what.
I would love to fix this if someone knows better and can indicate what else I can do wrong.
In fact, I was wrong. It turns out that the CSS compressor that we used to deploy the assets for servicing from a dedicated domain wrapped the entire piece of CSS using "@media screen {...}". I carefully compared @ font-face rules to make sure the compressor didn't mess with them, but never checked the beginning and end of the CSS file to catch this packaging. When I switched to the same service domain, this packaging did not happen.
As it turned out, IE and Firefox do not follow @ font-face declarations wrapped inside @media: Safari, Chrome, and Opera.
Sigh.
source share