[mercora]

more precisely a CNAME must be the only record type for a given label as it would be otherwise ambiguous to revolvers. that doesn't hold true for DNSSEC secured zones where the records for signatures are to be allowed, but also arent creating any ambiguity on how to resolve queries. the apex must have NS and SOA records for a minimum to work so that rules out any CNAME in addition to that. an apex without any other record but SOA and NS would work fine though. so saying it needs to be an A record implies the wrong thing.