Apex domains cannot have CNAME records.
Question and response
Question
dig blue-shield.at. NS
Answer
blue-shield.at. 5 NS ns2.netzpionier.at.
blue-shield.at. 5 NS ns3.netzpionier.at.
blue-shield.at. 5 NS ns1.netzpionier.at.
Authority
The response has no authority records.
Additional
ns1.netzpionier.at. 5 A 91.210.143.62
ns2.netzpionier.at. 5 A 91.210.143.61
ns3.netzpionier.at. 5 A 195.190.26.10
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0