Server-side tracking and CNAME cloaking
Why it matters Blockers and browsers decide what to stop mostly by looking at where a request goes. Some trackers dodge this by hiding inside the site itself. Knowing the trick explains why a blocker sometimes misses things, and why it can also put your login cookies at risk.
The tracker in a borrowed uniform
A shop has a guard who stops strangers at the door but waves staff through. A tracker that wears the shop's own uniform walks straight in. That is the idea behind both tricks in this lesson.
First party: the site shown in your address bar, here shopa.example.
Third party: any other company whose content the page loads, such as adco.example.
Trick 1: server-side tracking
Normally your browser sends tracking data straight to adco.example, where a blocker can see and stop it. With server-side tracking, your browser sends the data only to shopa.example. Then shopa.example's own server forwards it to adco.example, out of sight.
Usual: your browser -> adco.example (a blocker can stop this)
Server-side: your browser -> shopa.example -> adco.example (the second hop is invisible to you)Your browser only ever talks to the site you chose, so blockers have nothing to block. What is forwarded is decided on the shop's server, where no setting of yours can reach.
Trick 2: CNAME cloaking
DNS: the internet's phone book. Your browser asks it "where is shopa.example?" and gets back a server address.
CNAME: an entry in that phone book that says "this name is really an alias for that other name", like a phone number that quietly forwards to another one.
A site can create a name that looks like its own, such as metrics.shopa.example, and point it with a CNAME at the tracker: metrics.shopa.example -> shopa.adco.example. To your browser, the request goes to a part of shopa.example, so it looks first party.
That has two effects. The tracker can set cookies that count as shopa.example's own, which survive many third-party protections. And, more worrying, cookies that shopa.example set for all of its names, possibly including login cookies, may be sent to the tracker's server too.
The defences (checked October 2026)
- Safari limits cookies set through such disguised third parties to a short lifetime of about 7 days.
- Some blockers look behind the alias. Brave, and uBlock Origin running in Firefox, look up the CNAME and block the request if the real name is a known tracker.
- DNS-level blockers (on your router or device) can check aliases against lists too.
- Nothing in your browser can see server-side forwarding. There, your best tools are sharing less: not logging in when you do not need to, guest checkout, and the choices in the consent lessons.
A common misconception
"If every request goes to the site I am on, nobody else is watching." Both tricks exist precisely to make tracking look like the site talking to itself. If you build sites, avoid CNAME cloaking: besides breaking your visitors' trust, it can leak your own users' session cookies to another company.
Recap
- Server-side tracking forwards your data from the site's server, out of reach of any blocker.
- CNAME cloaking gives a tracker a name inside the site, so it looks first party.
- Cloaking can leak the site's cookies, including login cookies, to the tracker.
- Safari caps such cookies, and some blockers uncloak aliases (checked October 2026).
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.