Apex domains cannot have CNAME records.
Question and response
Question
dig us-1.a.mimecastprotect.com. NS
Answer
us-1.a.mimecastprotect.com. 5 NS ns-1127.awsdns-12.org.
us-1.a.mimecastprotect.com. 5 NS ns-509.awsdns-63.com.
us-1.a.mimecastprotect.com. 5 NS ns-781.awsdns-33.net.
us-1.a.mimecastprotect.com. 5 NS ns-1864.awsdns-41.co.uk.
Authority
The response has no authority records.
Additional
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0