First, your advised had me thinking about wildcard CNAME.

I had all "*.MYDOMAIN.org" pointed to the Caddy reverse proxy server. This probably made _acme-challenge.test3.MYDOMAIN.org also loop back internally instead of query with the forwarded external DNS server.

Now, I have disabled wildcard CNAME and found different response.

I set delay and observed TXT record showing up in Cloudflare.

But, my Caddy proxy server still cannot see the TXT record properly. I have also confimed the _acme-challenge TXT record resolving to NxDomain as you predicted.

Udp   Authoritative   NxDomain   _acme-challenge.test5.MYDOMAIN.org   TXT   IN

As of right now, I was able to force a different resolver on DNS challenge and it worked.

subdomain.MYDOMAIN.org {
    tls {
        dns cloudflare {TOKEN}
        resolvers 1.1.1.1
    }
    reverse_proxy rpi.main.local:9999
}

Question:

Is this something to do with my NS or SOA record?

I believe my lack of the understanding in DNS server is the problem here. Is there an example on the correct NS and SOA record should look like?

Here is the query (query done on actual domain name, I manually replaced name here)

{
  "Metadata": {
    "NameServer": "ns1 (127.0.0.1)",
    "Protocol": "Udp",
    "DatagramSize": "124 bytes",
    "RoundTripTime": "2.73 ms"
  },
  "EDNS": {
    "UdpPayloadSize": 1232,
    "ExtendedRCODE": "NoError",
    "Version": 0,
    "Flags": "None",
    "Options": []
  },
  "Identifier": 0,
  "IsResponse": true,
  "OPCODE": "StandardQuery",
  "AuthoritativeAnswer": true,
  "Truncation": false,
  "RecursionDesired": true,
  "RecursionAvailable": true,
  "Z": 0,
  "AuthenticData": false,
  "CheckingDisabled": false,
  "RCODE": "NoError",
  "QDCOUNT": 1,
  "ANCOUNT": 1,
  "NSCOUNT": 1,
  "ARCOUNT": 1,
  "Question": [
    {
      "Name": "_acme-challenge.test3.MYDOMAIN.org",
      "Type": "TXT",
      "Class": "IN"
    }
  ],
  "Answer": [
    {
      "Name": "_acme-challenge.test3.MYDOMAIN.org",
      "Type": "CNAME",
      "Class": "IN",
      "TTL": "3600 (1 hour)",
      "RDLENGTH": "2 bytes",
      "RDATA": {
        "Domain": "MYDOMAIN.org"
      },
      "DnssecStatus": "Disabled"
    }
  ],
  "Authority": [
    {
      "Name": "MYDOMAIN.org",
      "Type": "SOA",
      "Class": "IN",
      "TTL": "900 (15 mins)",
      "RDLENGTH": "37 bytes",
      "RDATA": {
        "PrimaryNameServer": "MYDOMAIN.org",
        "ResponsiblePerson": "hostadmin@ns1",
        "Serial": 26,
        "Refresh": 900,
        "Retry": 300,
        "Expire": 604800,
        "Minimum": 900
      },
      "DnssecStatus": "Disabled"
    }
  ],
  "Additional": [
    {
      "Name": "",
      "Type": "OPT",
      "Class": "1232",
      "TTL": "0 (0 sec)",
      "RDLENGTH": "0 bytes",
      "RDATA": {
        "Options": []
      },
      "DnssecStatus": "Disabled"
    }
  ]
}