Lightsail Certificates: Certificate validation always fails with external DNS managed by Cloudflare

Creating a certificate in AWS Lightsail, creating all the DNS validation records in Cloudflare and double checking every record via dig / nslookup always leads to failure:

Querying certificates returns confusing information:

aws lightsail get-certificates --include-certificate-details

                    {
                        "domainName": "test1.example.com",
                        "resourceRecord": {
                            "name": "_f0b4ecc67af2fbdffff2cc67af2fb.test1.example.com.",
                            "type": "CNAME",
                            "value": "_1cace108509243555135551fd5092435q.acm-validations.aws."
                        },
                        "dnsRecordCreationState": {
                            "code": "FAILED",
                            "message": "Auto validation failed because no matching DNS zone found in lightsail."
                        },
                        "validationStatus": "FAILED"
                    },

NOTE: Actual domain data (names, records) in screenshots and command output were redacted / changed.