DNSSEC broken + illegal CNAME at zone apex for shlink.io

[AWildLeon]

Two related DNS configuration issues on shlink.io:

1. CNAME at zone apex (invalid per RFC 1034/1035)

$ dig shlink.io @1.1.1.1

;; ANSWER SECTION:
shlink.io.              1799    IN      CNAME   a5ecwxrv.up.railway.app.
a5ecwxrv.up.railway.app. 60     IN      A       69.46.46.58

A CNAME is present at the zone apex itself (not a subdomain). Per RFC 1034/1035,
the apex must hold SOA/NS records and cannot have a CNAME coexisting with other
record types at the same name. This should be using CNAME flattening / ALIAS /
ANAME (as offered by most major DNS providers) to synthesize an A/AAAA record
at the apex instead of exposing a raw CNAME.

2. DNSSEC validation failure (SERVFAIL)

A DS record is published for shlink.io at the .io registry, but the zone does
not serve a valid DNSKEY/RRSIG chain:

dig shlink.io DNSKEY
# Returns SERVFAIL

resolvectl query shlink.io
# shlink.io: resolve call failed: DNSSEC validation failed: no-signature

This is likely caused by issue #1 - a zone with an invalid apex CNAME
generally cannot be signed correctly, since the apex also requires DNSKEY/
RRSIG records that can't coexist with a raw CNAME per spec.

Non-validating resolvers (8.8.8.8, 1.1.1.1 default mode) mask both issues by
skipping strict checks, so the site works for most visitors - but breaks for
anyone using DNSSEC-validating resolvers (e.g. systemd-resolved with
DNSSEC=allow-downgrade, Unbound, BIND with validation).

Suggested fix

Replace the apex CNAME with proper CNAME flattening / ALIAS / ANAME pointing at the Railway target, so the apex returns a synthesized A record.
Ensure the zone is properly DNSSEC-signed afterward.