That looks like a proper CNAME entry. I use a similar setup and Cloudflare didn’t stop me.
EDIT: you only need to type in “mail” for that CNAME. Leave your domain off.
Without seeing the rest of your DNS screen, I do think there’s probably already a IP address or CNAME entry for mail.onrchem.com
In addition, you don’t want that CNAME record set to 
, as Cloudflare doesn’t proxy email. Make sure it’s set to 
.