Managed proxy

Serve the tracker and its ingest endpoint from a neutral subdomain of your own domain, so adblockers have no third-party host to match.

Markdown
Updated Jul 28, 2026
On this page
  1. How it works
  2. Setup
  3. Neutral paths
  4. Disabling it

Adblockers commonly block analytics by matching the vendor's domain in the request URL. The managed proxy serves mrkr's tracker and ingest endpoint from a subdomain of your own domain instead, so there's no third-party host for a filter list to match.

How it works

You pick a neutral subdomain (something like a.yourdomain.com), CNAME it to mrkr's proxy target, and mrkr provisions a Cloudflare for SaaS custom hostname with an automatic TLS certificate. Once active, your snippet points at your own subdomain instead of mrkr.app, and requests to it are routed through to mrkr's ingest transparently.

Setup

  1. Enter a subdomain

    From Settings → Tracking → First-party proxy, type a subdomain of your site's domain (must be at least one level below the apex, a.example.com, not example.com) and enable the proxy.

  2. Add one CNAME record

    mrkr shows you a single CNAME record to add at your DNS provider, pointing your subdomain at mrkr's proxy target. If your DNS is also on Cloudflare, set the record to DNS-only (grey cloud), not proxied.

  3. Check status

    Click Check status to poll provisioning. It moves through Waiting for DNS → Provisioning certificate → Active, typically within 1–10 minutes once the CNAME is visible.

  4. Swap the snippet

    Once active, copy the updated install snippet: it now points at your proxy hostname instead of mrkr.app.

Neutral paths

A proxy hostname is only ever allowed to reach the tracker's own endpoints: /api/data, /api/data/r, /api/data/crawl, /api/collect, /api/replay, and /api/health. Every other route redirects home, so a customer subdomain can never accidentally serve mrkr's dashboard or marketing pages.

Disabling it

Disabling the proxy removes the custom hostname and revokes its certificate. Switch any pages still using the proxied snippet back to the standard one first, or they'll stop working once the certificate is gone.