That's an odd problem. A few possible causes jump to mind: A. Someone is poisoning it between you and Cloudflare, but only for DNS requests directed towards Cl

That's an odd problem. A few possible causes jump to mind: A. Someone is poisoning it between you and Cloudflare, but only for DNS requests directed towards Cloudflare. B. Someone is poisoning it between Cloudflare and Gandi. C. Someone was able to trick Cloudflare into thinking it is the authoritative DNS provider and its authoritative DNS servers are the same ones as its recursive resolvers. D. Something got missed in troubleshooting. (Not trying to be a jerk, it's just always a possibility.) You could probably surface whether it's A or B by playing around with DNSSEC. I'm not certain, but you might be able to figure out if it's C with this: https://rdap.cloudflare.com https://rdap.cloudflare.com