uBlock Origin aside, it feels like browsers should have built-in support for dealing with this technique (I'm thinking of Safari content blockers and Chrome declarative net requests). Otherwise it's all too easy for trackers to get around browser protections, rendering content blocking APIs almost useless. You should be able to block the resolved domain for a CNAME, not just the source domain...