they do, but you can optionally add one to your host server for stronger protection (in addition to the cloudflare one) and if you don't build your own automation or add a calendar reminder to update that one, well.

somewhere an engineer is having a bad day