Are you sure that Cloudflare supports ARC? Last time I checked they used SRS for sender rewriting (that's why SPF doesn't fail), but didn't support ARC yet.