What Is CNAME Cloaking and How It Bypasses Ad Blockers

CNAME cloaking is a way of disguising a tracking company's server as part of the website you're visiting. Because it looks like the site itself, it gets past third-party cookie blocking and some ad blockers.

How it works

1. A website creates a subdomain, such as metrics.example.com.
2. In its DNS settings, it points that subdomain at the tracking company's server using a CNAME record, a kind of alias.
3. The tracker's script loads from metrics.example.com, so your browser treats it as part of example.com.
4. It can set first-party cookies, which most browsers don't block, and recognize you on future visits.

Why it gets past blockers

• Third-party cookie blocking doesn't apply, because the cookies look first-party.
• Blocklists that match tracker domains, such as tracker.com, don't see the tracker's name in the address.
• Cookies the site sets for its whole domain, which can include login cookies, may be sent to the tracker too. Researchers have documented this kind of leak.

Who catches it

• uBlock Origin on Firefox can look up where a subdomain really points and block it if it's a known tracker. On Chrome, extensions can't look up DNS this way, so they rely on lists of known cloaked subdomains.
• Brave checks CNAME records in its built-in blocker.
• Safari limits how long cookies set through CNAME-cloaked servers last.
• DNS-level blockers, such as NextDNS or Pi-hole, see the whole chain of aliases and can block the tracker's real domain.

How to spot it yourself

1. Open DevTools (F12) → Network, and reload the page.
2. Look for requests to unusual subdomains of the site, such as smetrics., data. or long random names.
3. Look up the subdomain with a DNS lookup tool. A CNAME pointing to an analytics or ad company means it's a disguised tracker.

Is it legal?

It's a technical method, not a law in itself. In Europe, tracking still needs consent however it's delivered, so a site using CNAME cloaking for ads still needs your agreement. Rejecting cookie banners still matters.

What you can do

• Use a blocker that handles CNAME cloaking, or a DNS-level blocker.
• Clear site data for sites you don't revisit, or set Chrome to clear it when you close the browser.
• Reject non-essential cookies on banners.

More on related techniques: third-party tracking and localStorage tracking. Ghost Browser takes a different approach, adding random background visits so the profile trackers build is less accurate.