Yeah this is an interesting one! I typically use Netlify’s nameservers for my domains which helps keep things all under one tree, but I’m definitely seeing the issue you’re feeling. I’m not sure why my dig shows different than @luke’s too 
(though this is hours later and it may have changed)
nslookup:
jon$: nslookup inside.calpoly.edu
Server: 192.168.1.1
Address: 192.168.1.1#53
Non-authoritative answer:
inside.calpoly.edu canonical name = www.inside.calpoly.edu.
www.inside.calpoly.edu canonical name = cpc-inside-cp-blog.netlify.app.
Name: cpc-inside-cp-blog.netlify.app
Address: 104.248.60.43
Name: cpc-inside-cp-blog.netlify.app
Address: 159.65.216.232
jon$: dig inside.calpoly.edu
; <<>> DiG 9.10.6 <<>> inside.calpoly.edu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1403
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;inside.calpoly.edu. IN A
;; ANSWER SECTION:
inside.calpoly.edu. 300 IN CNAME www.inside.calpoly.edu.
www.inside.calpoly.edu. 300 IN CNAME cpc-inside-cp-blog.netlify.app.
cpc-inside-cp-blog.netlify.app. 20 IN A 104.248.63.248
cpc-inside-cp-blog.netlify.app. 20 IN A 104.248.50.87
;; Query time: 167 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Wed Aug 12 10:09:26 EDT 2020
;; MSG SIZE rcvd: 159
This all tracks though, because when I query the inside.calpoly.edu domain directly, the error comes from a certificate problem, not a routing problem:
jon$: http inside.calpoly.edu
GET / HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: inside.calpoly.edu
User-Agent: HTTPie/2.1.0
HTTP/1.1 301 Moved Permanently
Age: 0
Cache-Control: public, max-age=0, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: text/plain
Date: Wed, 12 Aug 2020 13:38:53 GMT
Location: https://inside.calpoly.edu/
Server: Netlify
X-NF-Request-ID: 192ebc9d-4550-4498-a330-94cae7930230-2410191
Redirecting to https://inside.calpoly.edu/
GET / HTTP/1.1
Accept-Encoding: gzip, deflate
Connection: keep-alive
Host: inside.calpoly.edu
User-Agent: HTTPie/2.1.0
http: error: SSLError: HTTPSConnectionPool(host='inside.calpoly.edu', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError("hostname 'inside.calpoly.edu' doesn't match either of '*.netlify.com', 'netlify.com'"))) while doing a GET request to URL: https://inside.calpoly.edu/
And the key issue there being "hostname 'inside.calpoly.edu' doesn't match either of '*.netlify.com', 'netlify.com'"
So all that said, yeah I fully agree that the issue originally written about is dead on 
I’m going to take a bit of time and play around with externally-hosted DNS on one of my demo sites and see how it behaves since that’s your use case here. I have occasionally had issues with subdo’s having SSL errors but I usually get around it by just assigning another random subdo to a different site (which prompts Netlify’s back end plumbing to regenerate the *.domain cert, covering all subdomains). The one oddity that’s tugging at my brain with this particular case is the push to a subdomain. Typically I think sites use the root domain and push www. traffic to the root… and it’s backwards in this case (which is totally fine) so I just want to play with that a little bit
–
Jon
many friends went there
Since that’s more of a personal-choice decision I typically don’t presume to advise people on what they should do in that area, but since you’ve asked, I would recommend not bothering with a www subdomain (btw, nice call on the bold for domains… that’s way nicer 
) since you’re already on a subdomain.
. If you try to www.my.denison.edu, it breaks because there’s nothing at the www.my. double-subdomain