I just registered a new domain with namecheap; I immediately changed my NS servers to CF which was 3 days ago.
When I dig NS records I can see CF servers are active and that’s expected!
What’s not expected is, I dig A or AAAA records on any subdomain and I see records that are not from CF?!? I’m surprised how this is possible?
What do you mean “not from CF”? Do you have an example?
Are you perhaps seeing Cloudflare’s Proxy IPs returned on a Proxied Record? If a record is set as Proxied in your Cloudflare Dashboard, Cloudflare will respond to DNS Queries with their own A/AAAA Records & IPs so that traffic flows through Cloudflare first, and Cloudflare can do its job as a CDN/Reverse Proxy (Caching, WAF, etc).