I agree. If they're going to be doing this, why not also use the Cloudflare apps framework to insert a warning overlay on the page content saying that the domai

I agree. If they're going to be doing this, why not also use the Cloudflare apps framework to insert a warning overlay on the page content saying that the domain has been reported for phishing. If that's too slippery slope, then so is the email _DMARC override settings. And doesn't this kind of behavior open them up to a lot of legal risk? By moderating _DMARC records, they're assuming responsibility for email content going into the future. If inappropriate content is then passed via email, and Cloudflare failed to blackhole it with _DMARC recordsy, then the can't they become liable for that content?