I think that you're right, it's related to Cloudflare's SaaS SSL product [1].
I'm totally ignorant of how it works but I guess that because everything is taking place within Cloudflare's network they're not hitting the DNS record after it's initially set up, they're just routing the traffic internally.
I'm totally ignorant of how it works but I guess that because everything is taking place within Cloudflare's network they're not hitting the DNS record after it's initially set up, they're just routing the traffic internally.
[1]: https://www.cloudflare.com/ssl-for-saas-providers/