Indeed. I have several domains using cf for dns only and they don't/can't inject anything into those sites.