Apex domains cannot have CNAME records.
Question and response
Question
dig xlfgrmvvlj.acm-validations.aws. NS
Answer
xlfgrmvvlj.acm-validations.aws. 5 NS ns-602.awsdns-11.net.
xlfgrmvvlj.acm-validations.aws. 5 NS ns-1896.awsdns-45.co.uk.
xlfgrmvvlj.acm-validations.aws. 5 NS ns-139.awsdns-17.com.
xlfgrmvvlj.acm-validations.aws. 5 NS ns-1200.awsdns-22.org.
Authority
The response has no authority records.
Additional
. 0 OPT ; payload 1232, xrcode 0, version 0, flags 0