The affiliate clicks filter you can't see — your tracking SaaS might be affected

This is not a browser extension blocking the request. The carrier network decides what loads.

Carriers rarely rely on a single filter. Many start from EasyList or similar blocklists at the DNS layer, then add security DNS, router-level controls, malware and phishing checks, and mobile content locks — all running on the carrier side, not on the user's device. One click can die because the domain is on a list, falls into a blocked category, or scores poorly on reputation — with no extension installed and nothing for the audience to see.

That is why this is so hard to spot: the block happens before your dashboards and in-house QA ever get involved.

• ▸Default carrier filtering is real and widespread. The clearest proof I found covers malware, phishing, and content controls — not products sold as ad blockers. Carriers market these as "security," "safe browsing," "web protection," "content lock," or "family safety."
• ▸The UK is the strongest example. Sky, Virgin Media, TalkTalk, and EE all document network-level filtering on their own sites, and several turn it on automatically or bundle it into standard plans.
• ▸The US matters but is harder to size. Charter says Security Shield is on by default for Advanced WiFi customers. Comcast rolls xFi Advanced Security in on gateway activation and has cited 18 million eligible households.
• ▸Carriers layer several filtering methods. EasyList-style lists are a common DNS baseline. Vendor-backed stacks also show up from Allot, CUJO AI, McAfee, and provider-owned DNS. Marketing talks security, but blocking known ad and tracker domains at the network layer is common in practice.
• ▸Legitimate sites do get blocked. TalkTalk publishes a HomeSafe appeal path. Spectrum has a URL check form. Xfinity offers website reassessment — proof that real domains get caught, not just obvious threats.

A click from your audience passes through several steps before a page loads. The carrier they use can block it at DNS or on the home router — long before your team can spot it from the office.

When the filter fires at step 2, steps 3–5 never happen. Server-side postbacks are missing. QA run from your office network — on a different carrier than the audience — sees nothing wrong.

These checks apply to every device on that carrier's network at once — phones, laptops, in-app browsers, TVs, and more — with no extension in sight. Missed clicks are easy to blame on "bad traffic," privacy settings, or noisy analytics when the real cause is upstream.

How many people may be affected, by market — my best estimate for each country. The UK and US account for most of the reach I could document.

Where I could tie a product to a named carrier with public documentation, I estimate between 30M and 95M affected users worldwide. My best single-number estimate is about 60M.

Shaded band = my low-to-high range, 30M–95M. Against DataReportal's 5.56B internet users at the start of 2025, that is roughly 0.5%–1.7% — about 1% at my best estimate. Bundled products with unclear uptake could push the real number higher, but I did not find enough public data to pin down a single figure beyond that.

Each country uses three numbers: a low estimate where filtering is clearly on by default and subscriber counts are published; a best estimate that adjusts for overlap between fixed and mobile, multi-SIM lines, and unclear activation; and a high estimate for the full reach of documented bundled products, capped at that country's internet-user total.

My estimates for markets where carriers document filtering on their own sites. These are modeled reach figures, not carrier-published subscriber counts. The Data column grades how strong the underlying sources are.

A

Strong on-the-record proof — carrier documents the product, default status, and filtering behavior clearly.

B

Solid public evidence — product page or vendor announcement, with some gaps on uptake or defaults.

C

Weaker evidence — bundled, opt-in, or activation and uptake remain unclear.

D

Weakest — product exists, but reach and default uptake are very uncertain.

Poland, Brazil, France, Germany, India, and Japan are not listed — I found opt-in-only products or launch announcements, not enough public data to estimate reach.

Each row links to a carrier with a public page, press release, or help doc that describes a consumer filtering product or a default restriction.

A

Strong on-the-record proof — carrier documents the product, default status, and filtering behavior clearly.

B

Solid public evidence — product page or vendor announcement, with some gaps on uptake or defaults.

C

Weaker evidence — bundled, opt-in, or activation and uptake remain unclear.

D

Weakest — product exists, but reach and default uptake are very uncertain.

Across these carriers, filtering usually stacks EasyList-style blocklists with reputation feeds and vendor platforms such as Allot, CUJO AI, and McAfee. Carrier sites rarely spell out which lists they use, but domain-level blocking of ads, trackers, malware, and risky categories is common.

The risk sits at the architecture level, not with any one vendor. It affects affiliate tracking SaaS and nearly all major affiliate networks — hosted click trackers, performance marketing platforms, partner management suites, and network redirect infrastructure all typically route traffic through CNAME-based custom domains, redirect chains, and shared vendor hostnames. In markets I tested, carrier DNS filtering sometimes interrupts that layer. It is not universal across every carrier or market, but the pattern is common enough to affect clicks and attribution whether you buy media in-house or run through a network. Use the blocklist checker above to see whether your tracking domain's CNAME chain appears on EasyList, DeadEnd, or Pexcn.

What you see in the numbers: fewer clicks, landing pages that never load, conversions that undercount, broken post-click attribution, odd gaps by country or network, and ROAS that looks worse than it should. Office-based QA will not reproduce the issue unless you test on the same ISP, router setup, or carrier SIM as your audience. Blaming bad traffic or privacy tools instead of a carrier block is the expensive mistake.

The practical test: compare what happens on the audience's carrier network in each target market against a clean network or resolver you trust. Two free tools make that workable at scale.

• ›Compare ISP DNS answers against Quad9, 1.1.1.1, 8.8.8.8, or an internal control resolver.
• ›Test the visible click domain, the landing domain, and the ultimate CNAME target separately.
• ›Watch for broken DNS responses such as NXDOMAIN or SERVFAIL, carrier block pages, silently rewritten answers, or TLS failures on specific networks.
• ›Run synthetic tests with a mobile-carrier SIM and a fixed-broadband ASN in the target market — not just by country label.
• ›Diff raw server logs by country + ASN + resolver path to find drop-offs between click and page view.
• ›Alert on spikes in first-hop failures and sharp deltas between server-side postbacks and browser-side conversions.

• ▸Favor SaaS with client isolation on a dedicated IP for custom tracking domains. That is the setup I have seen offer the best resilience against DNS filtering — you are not sharing click infrastructure with every other client on the platform.
• ▸Monitor domain reachability by audience market, ASN, and carrier DNS. Assume browser-only QA from your own network is insufficient.
• ▸Treat custom tracking domains like core production systems. Avoid risky naming patterns, disposable-looking redirect domains, and long redirect chains.
• ▸Continuously test both the customer-visible subdomain and the CNAME target. If a provider operates at the DNS/reputation layer, either can become the point of failure.
• ▸Keep a clear unblock process with carriers and vendors. TalkTalk, Spectrum, and Xfinity already publish appeal paths — others may too, even when the docs are thin.

You can still push back on false blocks — but only if you test from the same carrier networks your audience uses and treat tracking domains as production-critical.

• ▸Carriers do not publish everything. Many confirm a product exists but not how many customers use it, whether it is on by default, or which blocklists and feeds power it.
• ▸Overlap is hard to untangle. One person may use both home broadband and mobile filtering, and mobile line counts often exceed real users because of work phones, tablets, and multi-SIM plans.
• ▸Block rules are a black box. When a carrier labels something "malicious," "unsafe," "adware," or "phishing," the exact logic is rarely public — you see the block, not the rule that triggered it.