I'm failing to reproduce the errors you see. Checking the authoritative nameservers for `well.com` yields `23.22.72.90` for the A record and nothing for the AAAA record: % dig +trace NS well.com ... well.com. 172800 IN NS ns-1103.awsdns-09.org. well.com. 172800 IN NS ns-1783.awsdns-30.co.uk. well.com. 172800 IN NS ns-459.awsdns-57.com. well.com. 172800 IN NS ns-805.awsdns-36.net. % for i in ns-1103.awsdns-09.org ns-1783.awsdns-30.co.uk ns-459.awsdns-57.com ns-805.awsdns-36.net; do dig @$i +short A well.com; done 23.22.72.90 23.22.72.90 23.22.72.90 23.22.72.90 When querying Cloudflare's resolver, I get the same answer as what the authoritative servers return from where I am: % dig @1.1.1.1 +short A well.com 23.22.72.90 And I can see that some third-party websites all show correct functionality, including what Cloudflare returns: * https://dnsviz.net/d/well.com/dnssec/ * https://www.digwebinterface.com/?hostnames=well.com&type=A&useresolver=9.9.9.10&ns=all&nameservers= We can continue off-list if you like. -- Alexander Huynh Cloudflare, Inc.