Apex domains cannot have CNAME records.
Question and response
Question
dig security.berkeley.edu. NS
Answer
security.berkeley.edu. 5 NS adns3.berkeley.edu.
security.berkeley.edu. 5 NS adns2.berkeley.edu.
security.berkeley.edu. 5 NS adns1.berkeley.edu.
Authority
The response has no authority records.
Additional
adns1.berkeley.edu. 4 A 128.32.136.3
adns2.berkeley.edu. 4 A 128.32.136.14
adns3.berkeley.edu. 4 A 192.107.102.142
adns3.berkeley.edu. 4 AAAA 2607:f140:a000:d:0:0:0:abc
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0