staff.env.mydomain.com (CNAME) -> resourceName.mydomain.com (A)staff.prod.externaldomain.com (CNAME - not in Cloudflare) -> prod.mydomain.com (CNAME) -> resourceName.mydomain.comresourceName.mydomain.com (A) record, however I don't see traffic in Cloudflare Analytics, and my test IP block rule doesn't fire.staff.env.mydomain.com (CNAME) to "Proxied" directly, then I get a warning about "Advanced Certificate Manager being necessary, which I haven't got to testing yet; and this wouldn't be possible in my scenario #2 where the actual hostname is external to me as it is.