Can a browser keep using an old Cloudflare 301 redirect after I switch the DNS record to DNS only?

Yep. Switching the record to DNS-only stops new HTTP requests from being routed through Cloudflare, but it can’t revoke a 301 the browser already stored. A 301 is cacheable, so a browser may replay that redirect locally before it even reaches DNS or your origin. Check the behavior in a clean browser profile or with the browser cache disabled, then test the direct origin response after DNS has updated. If the old redirect is gone there but some people still get sent away, that’s usually client-side cache state; clearing that site’s cached data or waiting for the browser to revalidate is the practical fix. Don’t treat a DNS-only switch as a cache purge, and make sure the origin itself no longer returns the old redirect too.