The Disguise
As browsers (like Safari with ITP) and extensions (like uBlock Origin) began aggressively blocking third-party tracking domains, the tracking industry adapted with CNAME cloaking.
How it Works
Normally, a tracking request goes to analytics.tracker.com. An ad blocker sees this domain and blocks it.
With CNAME cloaking, the website owner creates a DNS record that point a first-party subdomain (e.g., metrics.yoursite.com) to the tracker's domain. To the browser, it looks like a first-party request, so it allows it. However, the DNS server resolves it to the tracker's server, which then processes the data and sets first-party cookies that it can read.
The Danger
Because the tracker is operating on a first-party subdomain, it has access to all first-party cookies set by the main domain. This includes authentication cookies. If the tracker is compromised, it could theoretically steal user login sessions.
Mitigation
Advanced blockers like uBlock Origin (on Firefox) and network-level tools like Pi-hole or AdGuard Home can perform CNAME uncloaking by inspecting the DNS resolution chain and blocking requests if they eventually resolve to a known tracking domain.