Apex domains cannot have CNAME records.
Question and response
Question
dig tinc.ws. NS
Answer
tinc.ws. 5 NS ns200.anycast.me.
tinc.ws. 5 NS dns200.anycast.me.
Authority
The response has no authority records.
Additional
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0