What is a tracking domain and why do I need one?

A tracking domain is a first-party subdomain (e.g., t.yourdomain.com) that serves the ClickStream SDK and sets cookies from your own domain. This ensures maximum cookie persistence across all browsers, bypasses ad blockers that target third-party scripts, and maintains full first-party data ownership.

How do I set up a tracking domain?

Create a CNAME DNS record pointing your tracking subdomain (e.g., t.yourdomain.com) to ClickStream's edge infrastructure. This typically takes under 5 minutes in your DNS provider's dashboard, and ClickStream automatically provisions an SSL certificate for the subdomain.

Does a tracking domain help with ad blockers?

Yes. Ad blockers primarily target known third-party analytics domains. A tracking domain serves the SDK from your own first-party subdomain, making it indistinguishable from your regular site assets. This significantly improves data collection completeness compared to third-party script loading.

Tracking Domain DNS Setup Guide | ClickStream Documentation

Your Dashboard Guides You Through This

When you log in to einstein.clickstream.com, the onboarding wizard walks you through DNS setup step by step. This guide explains what happens behind the scenes.

Privacy Profile

Cookie consent & GDPR

DNS Setup

You are here

Add Snippet

Script tag

Verify

Live data check

Done

Dashboard live

Why First-Party Tracking Matters

Third-party cookies are blocked by Safari ITP (since 2017), Firefox ETP (since 2019), and Chrome (phasing out 2024-2025). When your analytics SDK loads from a third-party domain, browsers cap cookie lifetimes to 7 days or block them entirely.

A CNAME tracking subdomain makes your SDK a first-party resource. Cookies set from t.yourdomain.com are treated identically to cookies from www.yourdomain.com — full 365-day persistence, no ITP restrictions, no ad-blocker interference.

Result: First-party tracking domains achieve significantly higher visitor recognition versus third-party infrastructure.

Step 1: Choose Your Subdomain

Select a subdomain that looks natural on your domain. Avoid obvious analytics-related names that ad blockers target.

Recommended	Avoid	Why
`t.yourdomain.com`	`analytics.yourdomain.com`	Short and not blocked by ad-blocker filter lists
`data.yourdomain.com`	`tracking.yourdomain.com`	Generic enough to avoid pattern-matching filters
`edge.yourdomain.com`	`pixel.yourdomain.com`	Not associated with common tracking patterns
`api.yourdomain.com`	`collect.yourdomain.com`	Blends with legitimate API infrastructure

Step 2: Create the CNAME Record

Point your chosen subdomain to the ClickStream edge network. The target CNAME value will be provided in your ClickStream dashboard when you add a new site.

Your CNAME target: feynman.clickstream.com (provided in your dashboard under Settings > Tracking Domain)

Cloudflare

Log into the Cloudflare dashboard and select your domain
Navigate to DNS > Records
Click Add Record
Set Type to CNAME
Set Name to your subdomain (e.g., t)
Set Target to feynman.clickstream.com
Important: Set Proxy Status to DNS Only (gray cloud). Do NOT use Cloudflare proxy (orange cloud) as it will interfere with SSL provisioning.
Click Save

# Cloudflare API (alternative)
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "Authorization: Bearer {api_token}" \
  -H "Content-Type: application/json" \
  --data '{
    "type": "CNAME",
    "name": "t",
    "content": "feynman.clickstream.com",
    "ttl": 1,
    "proxied": false
  }'

AWS Route 53

Open the Route 53 console and select your hosted zone
Click Create Record
Set Record Name to your subdomain (e.g., t)
Set Record Type to CNAME
Set Value to feynman.clickstream.com
Set TTL to 300 (5 minutes)
Click Create Records

# AWS CLI (alternative)
aws route53 change-resource-record-sets \
  --hosted-zone-id {zone_id} \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "t.yourdomain.com",
        "Type": "CNAME",
        "TTL": 300,
        "ResourceRecords": [{"Value": "feynman.clickstream.com"}]
      }
    }]
  }'

GoDaddy

Log into GoDaddy and go to My Products > DNS
Click Add under the DNS Records section
Set Type to CNAME
Set Name to your subdomain (e.g., t)
Set Value to feynman.clickstream.com
Set TTL to 1 Hour
Click Save

Namecheap

Log into Namecheap and go to Domain List > Manage
Click the Advanced DNS tab
Click Add New Record
Set Type to CNAME Record
Set Host to your subdomain (e.g., t)
Set Value to feynman.clickstream.com
Set TTL to Automatic
Click the green checkmark to save

Step 3: SSL Provisioning

After DNS propagation (typically 5-30 minutes), ClickStream automatically provisions an SSL certificate for your tracking subdomain using Let's Encrypt.

Go to your ClickStream dashboard > Settings > Tracking Domain
Enter your tracking subdomain (e.g., t.yourdomain.com)
Click Verify & Provision SSL
The system will verify the CNAME record and issue an SSL certificate
Status will change from "Pending" to "Active" when complete

Note: SSL provisioning typically completes within 2-5 minutes after DNS verification succeeds. If it takes longer than 30 minutes, check the troubleshooting section below.

Step 4: Verify Your Setup

Verify that your tracking domain is configured correctly:

# 1. Verify DNS resolution
dig t.yourdomain.com CNAME +short
# Expected: feynman.clickstream.com.

# 2. Verify SSL certificate
curl -I https://t.yourdomain.com/health
# Expected: HTTP/2 200

# 3. Verify SDK loads
curl -s https://t.yourdomain.com/cs.js | head -1
# Expected: First line of ClickStream SDK

Step 5: Configure Your API Key

With the tracking domain verified, add it to your SDK installation:

<script
  src="https://t.yourdomain.com/cs.js"
  data-site-id="YOUR_SITE_ID"
  data-key="cs_live_xxxxxxxxxxxxxxxxxxxxx"
  defer></script>

See the SDK Installation Guide for full installation instructions including NPM, SPA routing, and consent management.

Troubleshooting

DNS Propagation Delays

DNS changes can take up to 48 hours to propagate globally, though most providers complete within 5-30 minutes. To check current propagation status:

# Check multiple DNS servers
dig t.yourdomain.com CNAME @8.8.8.8 +short
dig t.yourdomain.com CNAME @1.1.1.1 +short
dig t.yourdomain.com CNAME @208.67.222.222 +short

CAA Records Blocking SSL

If your domain has CAA (Certificate Authority Authorization) records, you need to add Let's Encrypt as an authorized CA:

# Check existing CAA records
dig yourdomain.com CAA +short

# If CAA records exist, add this record:
# Type: CAA
# Name: @ (or your domain)
# Value: 0 issue "letsencrypt.org"

CNAME Flattening (Cloudflare)

If you are using Cloudflare with the proxy enabled (orange cloud), the CNAME will be "flattened" to an A record. This prevents ClickStream from provisioning SSL. Solution: set the record to DNS Only (gray cloud).

Ad Blocker Interference

Some advanced ad blockers maintain custom filter lists that may block known analytics CNAME patterns. If you see blocked requests:

Choose a subdomain that does not match common analytics patterns (see the subdomain selection table above)
Verify that your subdomain is not on popular ad-blocker filter lists such as EasyList or EasyPrivacy
Consider using a dedicated domain for tracking if your primary domain is widely blocked

Existing Subdomain Conflict

If the subdomain you chose already has a DNS record (A, AAAA, or another CNAME), you must delete the existing record before creating the new CNAME. DNS does not allow a CNAME to coexist with other record types on the same hostname.

Multiple Tracking Domains

If you operate multiple websites on different domains, each domain needs its own tracking subdomain:

Website	Tracking Domain	CNAME Target
`www.brandone.com`	`t.brandone.com`	`feynman.clickstream.com`
`www.brandtwo.com`	`t.brandtwo.com`	`feynman.clickstream.com`
`app.saasproduct.io`	`data.saasproduct.io`	`feynman.clickstream.com`

Each tracking domain gets its own SSL certificate and can be managed independently in the ClickStream dashboard. Cross-domain identity linking is handled via the identity graph — if a visitor is identified on one domain, their profile is automatically linked across all domains in your account.

Security Considerations

API keys are domain-locked — Each API key is restricted to your verified tracking domain. Requests from unauthorized domains are rejected.
TLS 1.2+ enforced — All connections to the tracking domain require TLS 1.2 or higher. TLS 1.0 and 1.1 are not supported.
HSTS headers — ClickStream sets Strict-Transport-Security headers on the tracking domain to prevent protocol downgrade attacks.
Data encryption — All event payloads are encrypted with AES-256-GCM using per-site encryption keys. Data at rest is encrypted in Cloudflare R2.
No data sharing — Your tracking domain serves only your SDK and your event data. There is no co-mingling with other customers.

Verification Checklist

CNAME record created pointing to feynman.clickstream.com
DNS propagation verified via dig command
SSL certificate provisioned (status "Active" in dashboard)
SDK loads from tracking domain (no 404 or SSL errors)
First-party cookie (_cs_id) is set with 365-day expiry
Events appear in the ClickStream Live View dashboard
No ad-blocker interference on the chosen subdomain
CAA records (if any) include letsencrypt.org

Setting Up Your Tracking Domain

Your Dashboard Guides You Through This

Why First-Party Tracking Matters

Step 1: Choose Your Subdomain

Step 2: Create the CNAME Record

Cloudflare

AWS Route 53

GoDaddy

Namecheap

Step 3: SSL Provisioning

Step 4: Verify Your Setup

Step 5: Configure Your API Key

Troubleshooting

DNS Propagation Delays

CAA Records Blocking SSL

CNAME Flattening (Cloudflare)

Ad Blocker Interference

Existing Subdomain Conflict

Multiple Tracking Domains

Security Considerations

Verification Checklist

Maximize Visitor Recognition. Maximize Revenue.

Setting Up Your Tracking Domain

Your Dashboard Guides You Through This

Why First-Party Tracking Matters

Step 1: Choose Your Subdomain

Step 2: Create the CNAME Record

Cloudflare

AWS Route 53

GoDaddy

Namecheap

Step 3: SSL Provisioning

Step 4: Verify Your Setup

Step 5: Configure Your API Key

Troubleshooting

DNS Propagation Delays

CAA Records Blocking SSL

CNAME Flattening (Cloudflare)

Ad Blocker Interference

Existing Subdomain Conflict

Multiple Tracking Domains

Security Considerations

Verification Checklist

Related Documentation

SDK Installation Guide

Migrating from GA4

Maximize Visitor Recognition. Maximize Revenue.