I don't get it, why ad-blockers can't request a DNSBL managed by them to know if that CNAME is authorized or not? Granted, it requires a bit more network request, but completely breaks the CNAME cloacking method.