Safari 27.2 stops capping your own cookies on CNAMEd sites

If you moved your click IDs and visitor cookies to your server to get past Safari’s 7-day limit, and your store runs on a www hostname at Shopify, the move may not have worked on Safari. Safari 27.2, out yesterday, fixes a bug that cut those cookies to 7 days anyway.

What WebKit said

The WebKit post for Safari 27.2, published on 26 October 2026, lists 20 bug fixes. One is under Networking:

Fixed cookies set by a top-level navigation’s own response being capped to a seven-day lifetime when the site’s hostname is CNAMEd to a different registrable domain.

Put plainly: when a browser loads a page, the server’s response to that request can set cookies. If the page’s hostname is a DNS CNAME that points to a name on another domain, Safari gave those cookies 7 days at most, whatever expiry the server asked for. The same fix is in Apple’s 27.2 beta release notes from 13 October. Neither the notes nor the post says which version brought the cap in.

Why your own site was caught

Safari’s tracking prevention has capped cookies from “CNAME cloaking” since November 2020. A tracker asks a site to point a subdomain such as track.example.com at the tracker’s own domain. The tracker’s server then sets cookies that look first-party. WebKit’s 2020 definition targets a subresource that resolves to a different domain from the page. It also says “the whole site can be CNAME cloaked, when it uses so called edge servers”, and that case was meant to be left alone.

The bug put the page’s own response in the capped group. And a CNAME to another domain is how the common hosts connect a custom domain:

Host	How a custom hostname connects	A CNAME to another domain?
Shopify	www → shops.myshopify.com; apex → A record 23.227.38.65	www yes, apex no
Netlify	subdomain → yoursite.netlify.app; apex → ALIAS, ANAME or A record	subdomain yes, apex no
Vercel	subdomain → a project CNAME such as …vercel-dns-017.com; apex → A record	subdomain yes, apex no

We checked this site’s own DNS today. www.trackingdesk.com is a CNAME to trackingdesk.netlify.app. The apex trackingdesk.com returns only A records. The same site, on the same host, got two different cookie lifetimes on Safari before 27.2, depending on which hostname the visitor landed on.

The read

The server-set cookie was the fix, and on these sites it was capped too. The standard advice for Safari is to set first-party cookies from your server, because ITP deletes cookies created in JavaScript after 7 days. On a www Shopify store, or any site whose hostname is a CNAME to its host, a cookie set on the page response hit the same 7 days. A click ID stored that way was gone for a buyer who clicked, left, and came back on day 8. A returning visitor became a new one.

The fix arrives slowly, and it moves your numbers. Safari 27.2 comes with the iOS 27.2 and macOS 27.2 updates. As people install them, returning-visitor rates, attributed conversions with a lag over 7 days and frequency counts can rise on Safari, with no change in who visited. That is the browser, not your campaigns.

The note covers the page’s own response, and nothing else. It does not mention cookies set by other requests to your servers, and it changes nothing for cookies set in JavaScript or for third-party CNAME cloaking, which stay at 7 days.

What to do

1. Check your hostname. Run dig +short CNAME www.yoursite.com. If it returns a name on another domain, such as your host’s, your Safari visitors before 27.2 were affected.
2. Split Safari reports by version for the next few weeks. Compare 27.2 with older versions before you read a rise in returning visitors or long-lag conversions as a result.
3. Do not read old Safari cohorts as churn. Repeat-visit and retention figures for Safari users on a CNAMEd hostname were cut short by the cap, not by what those users did.

A cookie that now lasts is only half the question. The other half is whether the platform’s click window and the cookie that carries the click ID were the same length to begin with, and for most platforms they are not: the click window rests on a cookie that may last 7 days.