On Thu Feb 08 00:07:22 2018, marka wrote:
> I would argue that the server is broken. CNAME + OTHER DATA at zone
> apex
> 
> [rock:~/git/bind9] marka% dig ds rs.dns-oarc.net @ns00.rs.dns-oarc.net
> +noadd +noauth
> 
> ; <<>> DiG 9.13.0-dev+hotspot+add-prefetch+marka <<>> ds rs.dns-
> oarc.net @ns00.rs.dns-oarc.net +noadd +noauth
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56551
> ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 106, ADDITIONAL: 107
> 
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 4096
> ;; QUESTION SECTION:
> ;rs.dns-oarc.net.               IN      DS
> 
> ;; ANSWER SECTION:
> rs.dns-oarc.net.        60      IN      CNAME   rst.x4090.rs.dns-
> oarc.net.
> 
> ;; Query time: 340 msec
> ;; SERVER: 64.191.0.133#53(64.191.0.133)
> ;; WHEN: Thu Feb 08 11:06:32 AEDT 2018
> ;; MSG SIZE  rcvd: 4090
> 
> [rock:~/git/bind9] marka%


Indeed.

I replied thus on the bind-users thread:

https://lists.isc.org/pipermail/bind-users/2018-February/099736.html