> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pixalate.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pixalate.com/_mcp/server.

# Serve tags from your own subdomain (CNAME)

> How to set up a CNAME custom subdomain for Pixalate Analytics tags - the DNS records for the pixel and JavaScript tags, the Pixalate-managed certificate, how to check your records and troubleshoot.

Publishers or supply partners sometimes strip or block Pixalate tags, which causes discrepancies between your numbers and Pixalate's. To prevent this, you create a dedicated subdomain on your own domain and point it at Pixalate's servers with CNAME records. Pixalate's pixel and JavaScript tags are then served from your domain instead of a Pixalate domain.

Pixalate serves the traffic for your subdomain, secures it with an SSL/TLS certificate and gives you updated tags that use it. You add a few DNS records.

## Before you start

* **Subdomain.** The subdomain is your Pixalate client ID on your domain, for example `clientid.example.com`. Your Customer Success representative confirms your client ID, or agrees another dedicated subdomain with you.
* **Tag type.** Tell Pixalate whether you use the 1x1 pixel tag, the JavaScript tag or both. This decides how many DNS records you need.
* **DNS access.** Someone on your team must be able to add records to your domain's public DNS.
* **CAA records.** If your domain has CAA records, they must allow Amazon to issue certificates: `amazon.com`, `amazontrust.com`, `awstrust.com` and `amazonaws.com`.

Your updated tags come from your Customer Success representative. They aren't generated in the Analytics dashboard.

## DNS records

Replace `clientid.example.com` with your subdomain.

| Type  | Name (host)                 | Points to (value)        | Needed for                |
| ----- | --------------------------- | ------------------------ | ------------------------- |
| CNAME | `clientid.example.com`      | `gateway.adrta.com`      | Pixel and JavaScript tags |
| CNAME | `ipds.clientid.example.com` | `ipds.gateway.adrta.com` | Pixel and JavaScript tags |
| CNAME | `cdn.clientid.example.com`  | `cdn.adrta.com`          | JavaScript tag only       |
| CNAME | `pix.clientid.example.com`  | `pix.adrta.com`          | JavaScript tag only       |
| CNAME | `ipv6.clientid.example.com` | `ipv6.adrta.com`         | JavaScript tag only       |

* **Pixel tag only:** add the first two records.
* **JavaScript tag:** add all five. Your JavaScript tag loads from `cdn.clientid.example.com`.

## Set up the certificate

Pixalate issues and manages the certificate for your subdomain through AWS Certificate Manager. You don't buy, send or renew a certificate, no private keys are exchanged, and the certificate renews automatically.

#### Confirm your subdomain and tag type

Agree your subdomain and tag type with your Customer Success representative.

#### Get the validation record

Pixalate requests a certificate for `clientid.example.com` and `*.clientid.example.com`, then sends you one validation record. It looks like this:

| Type  | Name (host)                      | Points to (value)                        |
| ----- | -------------------------------- | ---------------------------------------- |
| CNAME | `_xxxxxxxx.clientid.example.com` | `_xxxxxxxx.xxxxxxxx.acm-validations.aws` |

#### Add the records to your DNS

Add the CNAME records from the [table above](#dns-records) and the validation record. Add the validation record within 72 hours: after that, the validation request expires and Pixalate has to issue a new one.

#### Wait for Pixalate to confirm

Amazon validates your domain and issues the certificate. Pixalate installs it and tells you when setup is ready.

#### Switch to the updated tags

Pixalate sends you updated tags that use your subdomain. Switch your traffic to them only after Pixalate confirms setup is complete.

> **Warning**
>
> Never delete or change the validation record. Automatic renewal depends on it. If it's removed, renewal fails and your tags can stop working.

If you can't use a Pixalate-managed certificate, talk to your Customer Success representative about providing your own. You then renew it yourself and must send Pixalate each renewed certificate before the current one expires, or your tags stop working.

## Check your setup

Run these commands to confirm your records are publicly visible:

```bash
dig clientid.example.com CNAME +short
# expected: gateway.adrta.com

dig ipds.clientid.example.com CNAME +short
# expected: ipds.gateway.adrta.com

dig _xxxxxxxx.clientid.example.com CNAME +short
# expected: the validation value Pixalate sent you
```

If a command returns nothing, the record isn't publicly visible yet.

## Troubleshooting

* **A record doesn't resolve.** Check that you added it to the public DNS zone and that the name isn't doubled (some DNS tools add your domain automatically). DNS changes can take time to spread.
* **Certificate validation is stuck.** Check that the validation record resolves with the `dig` command above. If the validation request has expired, Pixalate can issue a new one.
* **The certificate can't be issued.** Check your [CAA records](#before-you-start).
* **Tags stopped working after a while.** Check that the validation record is still in place.

## Related

* [Choose an integration method](/analytics/integration-methods)
* [The Pixalate tag and macros](/analytics/tag-and-macros)
* [Traffic tags in your ad server](/analytics/ad-server-trafficking)

Questions? Contact [support@pixalate.com](mailto:support@pixalate.com).