Apex domains cannot have CNAME records.
Question and response
Question
dig spf-records.xero.com. NS
Answer
spf-records.xero.com. 5 NS ns-206.awsdns-25.com.
spf-records.xero.com. 5 NS ns-1383.awsdns-44.org.
spf-records.xero.com. 5 NS ns-867.awsdns-44.net.
spf-records.xero.com. 5 NS ns-1903.awsdns-45.co.uk.
Authority
The response has no authority records.
Additional
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0