The RFCs say a CNAME record at a zone apex is invalid.
The DNSSEC validator in recent versions of BIND was made a little too overzealous and ended up sometimes making the entire zone invalid when it hit such a record.
More here: https://kb.isc.org/docs/apex-cname-unsigned-delegation
Full disclosure: I work for ISC, although my activity on Reddit does not represent ISC in an official capacity.
Source: r/dns · by /u/OsmiumBalloon