Matrix cloudflare tunnels setup

Hey all, I decided to try setting up matrix/synapse via cloudflare tunnels.

I was following this guide

http://192.168.1.2:8009/_matrix/static/ shows

It works! Synapse is running

as does https://matrix.example.com/_matrix/static/

https://matrix.example.com/.well-known/matrix/server

comes up with 404. Is anything ever truly *well* known?

and matrix/synapse container shows 401 unauthorized when trying to access public rooms

synapse.http.matrixfederationclient - 676 - INFO - POST-87644 - {POST-O-3} [matrix.org] Got response headers: 401 Unauthorized

federation tester is showing

Hosts

_dc-srv.959fd81029a5._matrix._tcp.matrix.example.com.
Addresses

Errors

SRV record target _dc-srv.959fd81029a5._matrix._tcp.matrix.example.com. is a CNAME record, which is forbidden (as per RFC2782)

can anyone point me in the right direction?

I'm assuming this is still an issue with ./well-known or something.

cheers