Apex domains cannot have CNAME records.
Question and response
Question
dig protected.ca. NS
Answer
protected.ca. 5 NS ns2.protected.ca.
protected.ca. 5 NS ns1.protected.ca.
Authority
The response has no authority records.
Additional
ns1.protected.ca. 5 A 205.173.252.5
ns2.protected.ca. 5 A 205.173.254.5
ns1.protected.ca. 5 AAAA 2607:4480:2:1:205:173:252:5
ns2.protected.ca. 5 AAAA 2607:4480:2:1:205:173:254:5
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0