Apex domains cannot have CNAME records.
Question and response
Question
dig _spf.cisco.com. NS
Answer
_spf.cisco.com. 5 NS ns1.cisco.com.
_spf.cisco.com. 5 NS ns3.cisco.com.
_spf.cisco.com. 5 NS ns2.cisco.com.
Authority
The response has no authority records.
Additional
ns1.cisco.com. 5 A 72.163.5.201
ns2.cisco.com. 5 A 64.102.255.44
ns3.cisco.com. 5 A 173.37.146.41
ns1.cisco.com. 5 AAAA 2001:420:1101:6:0:0:0:a
ns2.cisco.com. 5 AAAA 2001:420:2041:5000:0:0:0:a
ns3.cisco.com. 5 AAAA 2001:420:1201:7:0:0:0:a
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0