Use CloudFlare DNS manager and NOT MiAB DNS

[alento]

Answered here:

Let's Encrypt certificate installation problem

I highly recommend that you choose option 2 from my initial reply to accommodate this. In this way, your MiaB will be responsible for only it’s DNS while Cloudflare will be responsible for all other DNS on the domain. You’ll need to copy the necessary records manually to Cloudflare for the rest of the domain (other than mail subdomain) and will need to maintain DNS for any other domains served by the box elsewhere…