It looks like a low-probability/high impact bug to me in https://dash.cloudflare.com/
This is rather simple to replicate.
- You need a domain (example1.tld) which had its DNSSEC setup started BUT not enabled on the registrar site and another one (example2.tld) which never had DNSSEC enabled or started.
- Enter example1.tld domain DNS management from the main page of the admin panel. Then click “DS Record” in the DNSSEC section. It will display correct DNSSEC record for example1.tld.
- Then, without doing anything else, use the quick domain switch panel (under the logo in the left top corner) to go to another domain (example2.tld) which does NOT have DNSSEC enabled.
- Click “Enable DNSSEC”. It will show the standard “it will take a minute to populate on the edge” and display a popup with new DNSSEC records. These DNSSEC record will be for example1.tld instead of example2.tld. Closing that and refreshing the page brings back correct records.