I wanted a tunnel to serve a hostname on a domain whose DNS lives somewhere other than Cloudflare. The obvious move: add a CNAME at the outside provider pointing to <tunnel-uuid>.cfargotunnel.com, same target Cloudflare itself writes when you run tunnel route dns.
It does not work, and the failure is at DNS resolution, before anything reaches the tunnel.
<uuid>.cfargotunnel.com has no public address record. Resolve it from a normal recursive resolver and you get nothing back. It is not a real host on the public internet. It only means anything inside Cloudflare’s own resolution path, where the proxy sees the CNAME target, recognises the tunnel UUID, and routes the request into the tunnel connection. That interception is the whole mechanism. A resolver outside Cloudflare has no such step, so it follows the CNAME, finds no address, and returns an empty answer.
So the real requirement is stricter than “point DNS at Cloudflare”. The zone itself has to live on Cloudflare with the record proxied, so requests enter Cloudflare’s edge and the CNAME gets resolved by the one party that knows what a tunnel UUID means.
I had assumed cfargotunnel.com was a normal hostname doing normal things. It is closer to a routing token that happens to be shaped like a domain name.
If you genuinely cannot move the zone, the tunnel is the wrong tool. You want something that terminates at a real, publicly resolvable address.
The tell, if you hit this: dig +short <uuid>.cfargotunnel.com returns nothing at all. Not NXDOMAIN, not an address. Empty.