For anyone else unfamiliar with CNAME cloaking, here's what I think is a much better explanation of the issue: https://webkit.org/blog/11338/cname-cloaking-and-bounce-trac...