Apex domains cannot have CNAME records.
Question and response
Question
dig dfn-cert.de. NS
Answer
dfn-cert.de. 5 NS dns1.rrz.uni-hamburg.de.
dfn-cert.de. 5 NS robin.dfn-cert.de.
dfn-cert.de. 5 NS deneb.dfn.de.
dfn-cert.de. 5 NS dns2.rrz.uni-hamburg.de.
dfn-cert.de. 5 NS rzdspc1.informatik.uni-hamburg.de.
Authority
The response has no authority records.
Additional
dns1.rrz.uni-hamburg.de. 5 A 134.100.33.228
dns2.rrz.uni-hamburg.de. 5 A 134.100.33.229
robin.dfn-cert.de. 5 A 193.174.13.65
rzdspc1.informatik.uni-hamburg.de. 5 A 134.100.9.61
dns1.rrz.uni-hamburg.de. 5 AAAA 2001:638:710:21:0:0:0:531
dns2.rrz.uni-hamburg.de. 5 AAAA 2001:638:710:21:0:0:0:532
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0