Update ssltls-subdomains.mdx

Clarify that Cloudflare SSL/TLS will only work for a subdomain if the DNS record is proxied

Author: simon-says

src/content/partials/dns/ssltls-subdomains.mdx

@@ -3,6 +3,10 @@
 
 ---
 
+:::note
+Cloudflare can only serve an SSL/TLS certificate for a DNS record when you set the record's [Proxy Status](/dns/proxy-status/) to Proxied. If you do not do this, the origin server your record points to will be responsible for supporting SSL/TLS connections.
+:::
+
 If your main domain is using Cloudflare's [Universal SSL certificate](/ssl/edge-certificates/universal-ssl/), that certificate also covers all first-level subdomains (`blog.example.com`).
 
 For deeper subdomains (`dev.blog.example.com`), use a [different type of certificate](/ssl/edge-certificates/universal-ssl/limitations/#full-setup).