Here is what’s putting those TXT records: Universal SSL in Cloudflare.
Turning it off removes those phantom TXT records.
Ok, I’ll wait a bit to see if that fixes things. Thanks again @kurt. I’ll open a PR against the fly docs to add a troubleshooting section that includes this scenario.