Sorry, I deleted my comment since I thought the issue was better explained/covered downthread: https://news.ycombinator.com/item?id=8382419

As for spoofing the DNS record, I was under the impression that you switched your domain's nameservers to point at Cloudflare and that's what's used to verify that you control the domain.