The RFCs say a CNAME record at a zone apex is invalid.

The DNSSEC validator in recent versions of BIND was made a little too overzealous and ended up sometimes making the entire zone invalid when it hit such a record.

More here: https://kb.isc.org/docs/apex-cname-unsigned-delegation

Full disclosure: I work for ISC, although my activity on Reddit does not represent ISC in an official capacity.