Apex domains cannot have CNAME records.
Question and response
Question
dig sec-ns.de. NS
Answer
sec-ns.de. 5 NS b.sec-ns.de.
sec-ns.de. 5 NS c.sec-ns.de.
sec-ns.de. 5 NS a.sec-ns.de.
sec-ns.de. 5 NS a.prim-ns.de.
Authority
The response has no authority records.
Additional
a.sec-ns.de. 5 A 195.180.210.17
a.prim-ns.de. 5 A 194.163.252.5
b.sec-ns.de. 5 A 195.180.210.156
c.sec-ns.de. 5 A 195.180.210.33
a.prim-ns.de. 5 AAAA 2a00:74c0:10:203:0:0:53:1
c.sec-ns.de. 5 AAAA 2a00:74c0:10:201:0:0:53:1
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0