Apex domains cannot have CNAME records.
Question and response
Question
dig pa. NS
Answer
pa. 5 NS ns1.anycastdns.cz.
pa. 5 NS a.lactld.org.
pa. 5 NS ssdns-tld.nic.cl.
pa. 5 NS ns.dns.br.
pa. 5 NS ns.nic.pa.
pa. 5 NS ns1.nic.pa.
pa. 5 NS dns-ext.nic.cr.
pa. 5 NS ns2.nic.pa.
pa. 5 NS ns2.anycastdns.cz.
Authority
The response has no authority records.
Additional
a.lactld.org. 1 A 200.0.68.10
ns.nic.pa. 167723 A 168.77.9.6
ns1.nic.pa. 167723 A 168.77.9.7
ns1.anycastdns.cz. 5 A 185.38.108.108
ns2.nic.pa. 167723 A 168.77.9.8
ns2.anycastdns.cz. 5 A 185.28.194.194
a.lactld.org. 1 AAAA 2801:14:a000:0:0:0:0:10
ns1.anycastdns.cz. 5 AAAA 2a00:fea0:dead:0:0:0:0:beef
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0