If you a CNAME record, Cloudflare is supposed to protect/obfuscate/hide the origin and instead returns an IP address (of Cloudflare’s edge) and proxys to the target of the CNAME. Zoho is looking to verify A = B, so obfuscation breaks the check and you need to the record so their check passes.