Just wanted to give everyone an update that I contacted support and asked them to make it so DNS calls were resolved internally. After a couple of back and forths, they got an engineer to make some changes (no insight into exactly what those were), but even then I had to go back and ask them to validate because my system was still trying to go out to Cloudflare.
After the second time, it is indeed only using internal calls. So clearly this is a known procedure.
If it was a “known” procedure it sure shouldn’t have taken “a couple of back and forths” and a second call because it wasn’t done correctly the first time.
Still think the best course of action for Sense is to fundamentally change the order of attempts at DNS resolution to local first, Cloudflare as fallback, possibly with an internal “state” to remember if internal “always fails” and do Cloudflare first. I would then include a fallback where this “state” is discard after, lets say, a week.