CNAME Cloaking: Disguising Third Parties Through the DNS
Summary: Palo Alto Networks describes CNAME cloaking, a DNS technique in which a website owner creates a CNAME record for a first-party subdomain that points to a third-party tracker's domain, so the browser treats the tracker's cookies as first-party and third-party cookie blocking is circumvented. After running for a month, the company's detector identified almost 43,000 cloaked subdomains across more than 38,000 root domains, with CNAME records pointing to domains belonging to 32 organizations largely focused on advertising or marketing analytics.
What's compelling: The cloaked subdomains point to 32 organizations, and the AdGuard and EasyPrivacy blocklists each cover less than 10% of what the detector found, so blocklist-based defenses leave most of this traffic unseen. CNAME cloaking hides where user data is sent and can leak information to third parties or create new vulnerabilities.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Privacy
- Related
- Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent Cyber Risks · Nov 15, 2026