CNAME cloaking
Does the browser see through a first-party subdomain that points to a third-party service?
CNAME cloaking hides a third party behind a subdomain of the site itself. The site creates a subdomain such as metrics.example.com and points it, through a DNS CNAME record, at a vendor’s server. To the browser the requests look first-party, so the vendor gets first-party cookies and avoids lists of third-party trackers.
The same technique is used for legitimate reasons, such as running your own server-side tagging. Browsers that counter it either look up the CNAME record and treat the request as going to the real destination, or limit the cookies such subdomains can set.
By browser
Brave
Blocked- Brave blocks any network requests where either the requested URL or that URL’s CNAME record matches any rules in Brave’s blocklists.
Chrome
No restrictions- No restrictions.
Edge
No restrictions- No restrictions.
Firefox
No restrictions- No restrictions.
Safari
Limited- Expiration of cookies set with
Set-CookieHTTP response headers is 7 days at most, if the response originates from a subdomain that has a CNAME alias to a cross-site origin, or if the subdomain is configured with A/AAAA records where the first half of the IP address does not match the first half of the IP address of the website the user is currently browsing. - Cookies set by the response to a top-level navigation are not capped, even if the site’s own hostname is a CNAME to another domain, such as a hosting provider. Safari 27.2+ New
Sources (2) · 2026-10-31
History
Safari 27.2 stops capping cookies on CNAME-hosted sites
Cookies set by the response to a top-level navigation are no longer capped at 7 days when the site’s own hostname is a CNAME to another domain, such as a hosting provider.
Safari caps cookies from CNAME-cloaked subdomains
Cookies set by HTTP response from a subdomain that is a CNAME alias for a third party expire after 7 days at most.
Brave uncloaks CNAME trackers
Brave 1.17 resolves the DNS of each request and blocks it if a CNAME record points to a domain on its blocklists.