Safari 27 Blocks Identity Resolution at the Domain Level — Ad Impact
Quick Answer: Safari 27 blocks identity resolution at the domain level — not just cookies — detecting CNAME aliases and tracker-associated subdomains before a connection is made (Apple Developer, 2026). This breaks remarketing, view-through attribution and frequency capping for roughly 27% of global mobile traffic. The fix: genuine first-party server-side tracking, not CNAME workarounds.
In this article
- What does Safari 27’s domain-level identity blocking do?
- How is Safari 27 blocking different from previous ITP restrictions?
- What is CNAME cloaking and why does Safari 27 block it?
- How much of your traffic does Safari represent?
- Which advertising use cases break under Safari 27?
- Does Safari’s 7-day cookie cap still apply alongside the new blocking?
- Does server-side tracking work around Safari 27 restrictions?
- What is the difference between CNAME cloaking and genuine first-party server-side tracking?
What does Safari 27’s domain-level identity blocking do?
Safari 27 blocks identity resolution infrastructure at the DNS/domain level — it detects when a subdomain resolves to a known tracking provider and prevents the connection before any data is exchanged (Apple Developer, 2026).
Here’s the thing: previous versions of Safari restricted what trackers could do after they loaded. Safari 27 stops them from loading at all. The browser inspects DNS records, identifies CNAME aliases pointing to third-party tracking infrastructure, and blocks the request at the network layer. No pixel fires. No cookie sets. No identity graph builds.
For advertisers, this means any tracking setup that relies on disguising third-party infrastructure as first-party — which includes the majority of advanced client-side tracking configurations — stops working entirely for Safari users. The question isn’t whether your tracking is affected. The question is how much revenue you’re misattributing because of it.
Safari 27 blocks identity resolution at the domain level, detecting CNAME aliases and tracker-associated subdomains before a connection is made — no data is exchanged (Apple Developer, 2026).
How is Safari 27 blocking different from previous ITP restrictions?
Previous ITP versions limited cookie lifetimes and partitioned storage — Safari 27 goes further by blocking the tracking infrastructure itself at the DNS/domain level before any request is made (Apple Developer, 2026).
ITP (Intelligent Tracking Prevention) has evolved in stages since 2017. Early versions capped third-party cookie lifetimes. Later versions partitioned localStorage, restricted referrer data, and imposed 7-day caps on client-side cookies. Each round narrowed what trackers could do with data they’d already collected.
Safari 27 changes the game fundamentally. Instead of limiting what happens after a tracker loads, it examines the DNS chain and blocks the connection when it identifies infrastructure associated with cross-site tracking. Translation: the tracker never loads, never sets a cookie, never fires an event. It’s the difference between limiting what someone can do inside your house and not letting them through the front door.
Related: Safari ITP Is Killing Your WordPress Attribution: Here Is What 7-Day Cookies Actually Cost You
What is CNAME cloaking and why does Safari 27 block it?
CNAME cloaking uses DNS records to make a third-party tracking domain appear as a subdomain of your site — Safari 27 detects this pattern and blocks it because the data still flows to a third party (CookieStatus, 2024).
The technique works like this: instead of loading a pixel from tracker.adnetwork.com, you create a DNS CNAME record that points data.yourstore.com to tracker.adnetwork.com. Browsers that don’t inspect DNS chains treat data.yourstore.com as first-party and allow full cookie access. It was the last widely-used workaround for cookie restrictions — and Safari 27 closes it.
Safari now resolves the full CNAME chain and checks whether the final destination belongs to a known tracking provider. If it does, the request is blocked regardless of what the subdomain looks like. The browser doesn’t care that your DNS says it’s first-party — it checks where the data actually goes.
How much of your traffic does Safari represent?
Safari holds roughly 27% of global mobile browser share and dominates in key e-commerce markets like the US, UK and Australia, where it frequently exceeds 40% on mobile (Statista, 2026).
That’s not a niche browser segment you can write off. If you’re running an English-language WooCommerce store targeting the US, UK or Australian markets, Safari users likely make up the largest single browser group in your analytics. And these aren’t casual browsers — Apple device owners index higher on purchase intent and average order value than the broader market.
Let that sink in. The browser used by your highest-value customers is the one blocking the most tracking. Every ad platform under-reports Safari conversions more than any other browser, and Safari 27 widens that gap further. If you’re making budget decisions from platform-reported ROAS without adjusting for Safari tracking loss, you’re systematically undervaluing your best-performing audience.
Which advertising use cases break under Safari 27?
Cross-session remarketing, view-through attribution, frequency capping across sessions, and conversion tracking from ad clicks to purchases all break when identity resolution is blocked at the domain level (Apple Developer, 2026).
| Ad capability | What it needs | Safari 27 impact |
|---|---|---|
| Cross-session remarketing | Persistent user identity across visits | Blocked — no identity persists |
| View-through attribution | Impression-to-conversion identity link | Broken — impression events don’t fire |
| Frequency capping | Cross-session ad exposure count | Broken — each session appears new |
| Click-to-conversion tracking | Click ID stored in cookie | Degraded — 7-day cap + blocked domains |
| Lookalike audiences | Conversion event data for modelling | Weakened — missing Safari conversions |
Every one of these capabilities assumes the ad platform can link a user across sessions. When identity resolution is blocked at the domain level, each Safari visit looks like a brand new user. Your remarketing audiences shrink, your frequency caps reset every session, and your attribution models lose the conversions they need to optimise.
Does Safari’s 7-day cookie cap still apply alongside the new blocking?
Yes — the 7-day cap on client-side JavaScript cookies remains in full force and now compounds with the domain-level blocking (CookieStatus, 2024).
Safari’s restrictions are additive, not replacements. The 7-day cookie cap means any cookie set by JavaScript expires after 7 days, regardless of the expiry you specify. Domain-level blocking means tracking infrastructure that relies on CNAME cloaking or known tracker domains gets blocked before it even loads. Together, they create a double layer: even if a tracking script somehow loads on Safari, its cookies still expire in 7 days. And for the infrastructure Safari blocks at the domain level, there’s no cookie at all.
Safari’s 7-day cookie cap persists alongside the new domain-level blocking — the restrictions compound rather than replace each other, creating two independent layers of tracking loss (CookieStatus, 2024).
For WooCommerce stores, this means any purchase cycle longer than 7 days — furniture, electronics, B2B — loses attribution entirely on Safari, even before the new domain blocking is factored in.
Does server-side tracking work around Safari 27 restrictions?
Server-side tracking on a genuinely first-party subdomain — not a CNAME alias — routes events through your own infrastructure and is unaffected by Safari 27’s domain-level blocking (Apple Developer, 2026).
The distinction is critical. Safari 27 blocks infrastructure that pretends to be first-party. It doesn’t block infrastructure that is first-party. When your tracking events flow through a subdomain that resolves to your own server — not a CNAME pointing to a third-party tracker — Safari has no tracking domain to block. The events fire, the data reaches your server, and your server forwards it to Google Ads, Meta, TikTok, or wherever it needs to go.
For WooCommerce stores, tools like Transmute Engine handle this from a WordPress plugin — routing conversion events server-side through a genuine first-party endpoint to ad platforms and analytics. No CNAME tricks, no third-party DNS chains, no domain-level blocking. The server sets its own cookies with the full expiry you specify, bypassing the 7-day JavaScript cookie cap as well.
What is the difference between CNAME cloaking and genuine first-party server-side tracking?
CNAME cloaking points a DNS record at a third party’s server to fake a first-party relationship — genuine first-party server-side tracking runs your own server code on infrastructure you control (Apple Developer, 2026).
With CNAME cloaking, data.yourstore.com resolves to tracker.adnetwork.com. The browser sees your domain, but the data goes to someone else’s server. Safari 27 follows the DNS chain and catches this. With genuine first-party tracking, data.yourstore.com resolves to a server you control. Your code processes the event, sets cookies as a true first party, and then sends the data to ad platforms via server-to-server API calls. Safari sees a legitimate first-party request because it is one.
The practical difference: CNAME cloaking is a DNS trick that browsers are increasingly catching. Genuine first-party server-side tracking is an architecture that works with browser privacy restrictions rather than against them — and it’s the only client-side-proof approach that survives Safari 27.
Key Takeaways
- Safari 27 blocks at the infrastructure level: identity resolution is prevented before any request is made, going far beyond previous cookie restrictions.
- CNAME cloaking is dead on Safari: the browser resolves DNS chains and blocks connections to known tracker domains regardless of the subdomain name.
- 27% of mobile traffic is affected: Safari dominates in high-value e-commerce markets, meaning your highest-spending customers are the hardest to track.
- Genuine first-party server-side tracking survives: events routed through your own server infrastructure are unaffected because they are legitimately first-party.
Safari 27 blocks identity resolution infrastructure at the DNS/domain level — it detects when a subdomain resolves to a known tracking provider and prevents the connection before any data is exchanged.
Previous ITP versions limited cookie lifetimes and partitioned storage — Safari 27 goes further by blocking the tracking infrastructure itself at the DNS/domain level before any request is made.
CNAME cloaking uses DNS records to make a third-party tracking domain appear as a subdomain of your site. Safari 27 detects this pattern and blocks it because the data still flows to a third party.
Safari holds roughly 27% of global mobile browser share and dominates in key e-commerce markets like the US, UK and Australia, where it frequently exceeds 40% on mobile.
Cross-session remarketing, view-through attribution, frequency capping across sessions, and conversion tracking from ad clicks to purchases all break when identity resolution is blocked at the domain level.
Yes — the 7-day cap on client-side JavaScript cookies remains in full force and now compounds with the domain-level blocking, creating two independent layers of tracking loss.
Server-side tracking on a genuinely first-party subdomain — not a CNAME alias — routes events through your own infrastructure and is unaffected by Safari 27’s domain-level blocking.
CNAME cloaking points a DNS record at a third party’s server to fake a first-party relationship. Genuine first-party server-side tracking runs your own server code on infrastructure you control.