How can I add public DNS failover while keeping Cloudflare authoritative?

OctoDNS is worth looking at. It can manage the same records across multiple DNS providers, including Cloudflare, so you can publish the zone to more than one provider and choose nameservers from both. The tradeoff is that OctoDNS becomes the system managing the records rather than Cloudflare being the only source of truth.

For DMARC platforms, direct writes to Cloudflare often aren’t necessary. Many use CNAME delegation, where the DMARC-related record points to a name hosted by the vendor. That avoids giving the platform write access to your zone, but it is different from having the vendor push records directly through Cloudflare’s API. Confirm which model PowerDMARC supports and whether your requirement is about DNSSEC chain of custody or simply reducing the impact of a Cloudflare outage.

If the goal is only disaster recovery, a synchronized copy in another provider may be enough. Older services and some current DNS platforms can replicate changes into providers such as Route 53, with the backup zone kept ready to serve. Make sure the failover design includes DNSSEC key handling and that both providers can serve a consistent signed zone; otherwise the backup may not actually be usable during an outage.

DNSControl provides a similar setup. It can manage Cloudflare and Azure DNS from one configuration and keep the zones synchronized. This works well if you’re comfortable treating a configuration file and deployment process as the authoritative source for DNS changes.

What you’re describing is usually called secondary DNS or public DNS delegation. A secondary provider receives a copy of the authoritative zone, often through zone transfers or a provider-specific sync mechanism. You then publish nameservers from both providers at the registrar so either service can answer queries. Check whether Cloudflare supports the exact primary-to-secondary arrangement you need, since some hosted DNS platforms are designed to be the primary rather than provide traditional outbound transfers.