I would argue that the server is broken. CNAME + OTHER DATA at zone apex

[rock:~/git/bind9] marka% dig ds rs.dns-oarc.net @ns00.rs.dns-oarc.net +noadd +noauth

; <<>> DiG 9.13.0-dev+hotspot+add-prefetch+marka <<>> ds rs.dns-oarc.net @ns00.rs.dns-oarc.net +noadd +noauth
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56551
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 106, ADDITIONAL: 107

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;rs.dns-oarc.net.		IN	DS

;; ANSWER SECTION:
rs.dns-oarc.net.	60	IN	CNAME	rst.x4090.rs.dns-oarc.net.

;; Query time: 340 msec
;; SERVER: 64.191.0.133#53(64.191.0.133)
;; WHEN: Thu Feb 08 11:06:32 AEDT 2018
;; MSG SIZE  rcvd: 4090

[rock:~/git/bind9] marka%