Domain is registered in Route53, nameservers delegated to Cloudflare (authoritative DNS), site hosted on Vercel.
Vercel auto-created an A record (216.198.79.1) and *CNAME www → .vercel.app, which works in DNS-only mode.
Enabling Cloudflare proxy (orange-cloud) causes redirect loops / ERR_TOO_MANY_REDIRECTS and Vercel marks the domain invalid.
Looking for the correct Cloudflare + Vercel architecture, including which records must remain DNS-only and why proxying breaks TLS/redirect handling.