Hi @kirstygems,
Are you still running into issues with this?
What are the CNAMEs you are trying to add? It may be that to validate them, you will need to change the records from 
to 
, this means they won’t be proxied through Cloudflare and Picfair should see the records directly.
The message about exposing your origin IP should be clarified by a small orange symbol on the left hand side of the record that does that. It probably is your Wildcard record as that can’t be proxies unless you are on an Enterprise plan. You can most likely delete it if you don’t have a large number of subdomains (something.yourdomain.com) that don’t each have their own record.
Then on to the other issues:
- If you don’t have DNSSEC enabled then don’t worry about DS records, it’s an extra security feature which you may want to consider at some point, but if it’s disabled, it shouldn’t affect what you are trying to do.
- Does your site work OK when you visit it? If not, what error do you get?
- If you see “Mixed Content” or “Not fully secure” messages when visiting your site, this can be an issue. This post explains what it is: Mixed Content and Community Tip - Fixing mixed content errors has some good tips on resolving it.