Once you authorize any domain that resolves to Cloudflare POP IPs you’re going to end up with gigantic holes that essentially neuter this approach. It may work

Once you authorize any domain that resolves to Cloudflare POP IPs you’re going to end up with gigantic holes that essentially neuter this approach. It may work in the limited context that is your IoT network but for any corp, user of the web, etc Cloudflare IPs will open almost immediately for all but the most selective (non-CF) DNS records. Or you don’t allow any CF DNS records or IP ranges and cut yourself off from half the internet. That’s what parent meant.