How Safari Blocks CNAME Cloaking by Third-Party Trackers

This article explores how Apple's Safari web browser defends user privacy against CNAME cloaking, a workaround used by third-party analytics providers to bypass anti-tracking protections. It covers the mechanics of CNAME cloaking, how Safari's Intelligent Tracking Prevention (ITP) identifies disguised trackers by analyzing DNS records and IP addresses, and the strict seven-day cookie expiration limit Safari enforces to neutralize this tracking method.

What is CNAME Cloaking?

Because modern browsers block standard third-party cookies by default, analytics providers use CNAME (Canonical Name) cloaking to disguise their tracking scripts as first-party content.

A website owner creates a subdomain (such as metrics.example.com) and sets up a DNS CNAME record that points this subdomain to a third-party analytics server (such as collector.tracker.com). When a user visits example.com, the browser sees the request to metrics.example.com as a safe, first-party request. This allows the third-party tracker to set persistent HTTP cookies and read existing first-party cookies, bypassing standard browser privacy blocks.

How Safari Detects CNAME Cloaking

Apple addresses this vulnerability through its Intelligent Tracking Prevention (ITP) feature. Rather than blindly trusting a subdomain just because it shares a name with the host website, Safari inspects the underlying DNS resolution process.

Safari detects CNAME cloaking through a three-step verification process:

  1. DNS Resolution Inspection: When a webpage makes a request to a subdomain, Safari checks the DNS response to see if a CNAME record was used to route the traffic.
  2. Domain Comparison: If a CNAME record is present, Safari compares the original website's domain with the final destination domain specified by the CNAME record.
  3. IP Address Verification: Safari analyzes the IP addresses of both the host website and the CNAME destination. If the CNAME resolves to a domain that differs from the main website, and the IP addresses do not belong to the same network owner (specifically, if they do not share the same /24 IPv4 prefix or /48 IPv6 prefix), Safari flags the subdomain as a third-party CNAME cloak.

How Safari Neutralizes the Tracking

When Safari confirms that a subdomain is using CNAME cloaking to route data to a third party, it does not block the connection entirely, as doing so could break legitimate website functionality (such as Content Delivery Networks). Instead, Safari neutralizes the tracker's ability to maintain long-term user profiles by restricting its cookies.

Normally, cookies set via HTTP responses (Set-Cookie headers) from a true first-party server can last for months or years. However, if the Set-Cookie header originates from a server flagged for CNAME cloaking, Safari automatically caps the lifespan of those cookies to a maximum of seven days.

Even if the third-party analytics provider instructs the browser to keep the cookie for a year, Safari overwrites this instruction. If the user does not return to the website within seven days, the cookie is deleted, severely limiting the analytics provider's ability to track the user across time.