Apex domains cannot have CNAME records.
Question and response
Question
dig protonmail.ch. NS
Answer
protonmail.ch. 5 NS ns2.protonmail.ch.
protonmail.ch. 5 NS ns3.protonmail.ch.
protonmail.ch. 5 NS ns1.protonmail.ch.
Authority
The response has no authority records.
Additional
ns1.protonmail.ch. 5 A 185.70.42.150
ns2.protonmail.ch. 5 A 176.119.200.150
ns3.protonmail.ch. 5 A 205.132.47.1
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0