When you set up CNAME and certain other records in Cloudflare DNS, it defaults to (and heavily discourages you to disable) "proxied" records, which I believe means that the record points to a Cloudflare-owned host which then acts as a reverse proxy to whatever value you'd set. So from the console it looks like you've set the CNAME to a certain value, but in practice it'll be set to a different thing and transparently forward everything via Cloudflare. This is probably where the analytics get inserted, alongside a bunch of other Cloudflare features.
You can disable this, at which point the record will be set as a normal DNS record.
I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.
In this case, I was specifically using the domain registrar product from Cloudflare alongside other tools. Later, I moved a bunch of stuff away from Cloudflare but kept using them to manage my domains for the convenience — as part of that move, I ran into this issue.
I agree that it makes sense to link products together ("vertical integration" and all that), but I think it's very confusing to have a DNS dashboard that lets you configure DNS how you like, but then by default doesn't set up the DNS as you configured it. That's a weird choice.
>I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.
You could say the same about the reverse, ie. people set up their site on cloudflare, thought it was "protected", but really it's dns only and their servers are wide open. It's even worse if they migrated from another provider that was providing ddos protection.
I don't think this particular feature helps there, though. If you set your site up on Cloudflare, you'll probably explicitly want the proxy stuff, and that's very easy to set up. But if you buy a domain on Cloudflare, then you're already not looking specifically at the proxy products, you're looking at something else. And if you start configuring that domain in an admin panel that looks like it's offering you direct DNS configuration, and then you later realise that the DNS configuration has ended up completely different to how you set it up, then that's a bit weird. Like, if I set `CNAME` in DNS, then I expect the DNS CNAME record to be what I set it to.
You can disable this, at which point the record will be set as a normal DNS record.
I can see the advantage of Cloudflare's proxy systems, but I wish they'd be clearer about when they're being used and not pretend that this is some DNS feature or that records have been set to one thing when they've actually been set to something else. If nothing else, it makes debugging DNS issues a lot more confusing, particularly if you're not a DNS expert.