What is CNAME cloaking in website tracking?

CNAME cloaking is an arrangement in which a website’s subdomain points, through a DNS alias, to infrastructure operated by an external tracking provider. The browser-facing address uses the website’s domain, although another organisation handles the requests.

For example, metrics.example.com might resolve to an analytics vendor’s servers. This makes the distinction between first-party and third-party tracking harder to assess from the visible hostname alone.

CNAME records have legitimate uses, including connecting websites to hosting services. The privacy concern arises when the arrangement conceals an external tracker or helps it evade protections based on domain names. WebKit’s explanation of CNAME cloaking describes this technique and browser measures designed to address it.

During a website tracking audit, check:

• Where the subdomain resolves and who operates the destination.

• Which identifiers, cookies and event details are transmitted.

• Whether the provider uses information across different websites.

• Whether requests respect the visitor’s consent choices.

CNAME cloaking should also be distinguished from server-side tracking. A DNS alias changes how a destination is addressed; it does not necessarily mean the website’s own server receives and controls the data before forwarding it.