# Interesting article: CNAME Cloaking

**URL:** <https://community.ipfire.org/t/interesting-article-cname-cloaking/436>\
**Category:** Security\
**Created:** [27 November 2019 22:45 UTC](https://community.ipfire.org/t/interesting-article-cname-cloaking/436 "2019-11-27T22:45:53Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\
**Post date:** [22 March 2022 12:21 UTC](https://community.ipfire.org/t/interesting-article-cname-cloaking/436/3 "2022-03-22T12:21:30Z")

</div>

Hi,

> [@trish](#):
>
> Is there anything that could reveal and protect from CNAME cloaking in combination with the URLfilter?

hm, I don’t really think so.

From a web proxy perspective, the cloaked domains are not to spot as such unless the `CNAME` resolving chain is taken into account. Squid, as far as I am aware, does not support such additional DNS inspections, and given the fact that many legitimate sites resolve via a couple of `CNAME`s as well, this would be a tedious job to do.

Blocking the IP address of the advertising/tracker server is possible, but I would expect professional tracking services to host their stuff behind large CDNs, making them unblockable via the IP addresses, since one IP serves thousands of websites. (Someone once said Cloudflare is today’s biggest darknet, and in a way, that’s true… 😑 )

Therefore, I am afraid the web proxy won’t really help here unless it has an up-to-date list of these tracking subdomains at hand. The rest is up to the browsers, and in doubt, I think putting the shields up _there_ is more worth the effort.

Thanks, and best regards,  
Peter Müller

---

_[View the full topic](https://community.ipfire.org/t/interesting-article-cname-cloaking/436)._