"If a domain name is a CNAME (also known as an alias) for another domain, then the certificate authority looks for the CAA record set at the CNAME target (just like any other DNS lookup). If no CAA record set is found, the certificate authority continues searching parent domains of the original domain name.
For example, if blog.example.com is a CNAME for blogprovider.example, then the certificate authority looks for CAA record sets in the following order:
"Cloudflare adds CAA records automatically in two situations:
When you have Universal SSL or advanced certificates and add any CAA records to your zone. When you have Universal SSL enabled and enable AMP Real URL or SXG Signed Exchanges."
1) Isn't CF pages using universal SSL behind the scenes? 2) Is there a way for me to create CAA records on a free plan?