**Before you tell me about `Access-Control-Allow-Origin` and whitelisting, assume for the sake of argument that I can't touch the HTTP headers.**

**This is a hypothetical question.**

---

My question: 

* let's say I have an app available at a domain and I want to send a POST request from another domain, but I own both domains.
* let's also say, for the sake of argument, that I'm not at liberty to adjust CORS settings

So I can make an ajax request from `website.com` to `app.website.com`. but I have a second website, `website2.com`, which would also like to make an ajax request to `app.website.com`

If I were to create two CNAME records for `app.website.com` so that `app.website2.com` would point to the same app, could I then make an ajax request from either domain without necessitating the setting of `Access-Control` headers?

As far as I can tell, the only problem would be a possible SEO penalty from Google for not having a canonical URL for app.website.com, which is irrelevant as in my thought experiment it's basically just an endpoint.

Anybody illuminate me?