Apex domains cannot have CNAME records.
Question and response
Question
dig cert.fi. NS
Answer
cert.fi. 5 NS ns1.z.fi.
cert.fi. 5 NS nsp.dnsnode.net.
cert.fi. 5 NS ns1.traficom.fi.
cert.fi. 5 NS ns2.traficom.fi.
cert.fi. 5 NS ns2.z.fi.
cert.fi. 5 NS ns-secondary.funet.fi.
Authority
The response has no authority records.
Additional
ns1.traficom.fi. 5 A 87.239.125.186
ns2.traficom.fi. 5 A 87.239.125.187
ns-secondary.funet.fi. 5 A 128.214.248.132
ns1.traficom.fi. 5 AAAA 2a00:13f0:0:1002:125:184:0:2
ns2.traficom.fi. 5 AAAA 2a00:13f0:0:1002:125:184:0:3
ns-secondary.funet.fi. 5 AAAA 2001:708:10:55:0:0:0:53
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0