Comment by cobertos

Id caution against using Cloudflare for DNS. They rewrite your CAA record so multiple other CAs can sign certs on your domains. It's non-obvious unless you query your own CAA record