When users have multiple domains, tunnel route dns would incorrectly use the default zoneID from the login certificate, creating an invalid CNAME record (e.g. app.domain1.com.domain2.com).
This fix introduces ListZones in cfapi to fetch all valid zones for the account and explicitly checks if the provided hostname exactly matches or is a subdomain of a discovered zone, preventing this behavior and dynamically adjusting the endpoint to the correct Zone ID.
@StringerBell69
Nuno Diegues