Apex domains cannot have CNAME records.
Question and response
Question
dig okta.com. NS
Answer
okta.com. 5 NS ns-cloud-a2.googledomains.com.
okta.com. 5 NS ns-285.awsdns-35.com.
okta.com. 5 NS ns-684.awsdns-21.net.
okta.com. 5 NS ns-1563.awsdns-03.co.uk.
okta.com. 5 NS ns-1459.awsdns-54.org.
okta.com. 5 NS ns-cloud-a1.googledomains.com.
okta.com. 5 NS ns-cloud-a4.googledomains.com.
okta.com. 5 NS ns-cloud-a3.googledomains.com.
Authority
The response has no authority records.
Additional
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0