Comment by pests

The cname is just a normal domain. That DNS entry is a real entry. The CNAME is real. You can go directly to that address too. If someone else knows the cname destination they could go to it or cname their own domain to it literally like any other domain.

The only specially handling is cloud flare has a mapping from subdomain to your private network via it's agent and that's it.

I don't get what's the wrong or complicated about this.