We're suggesting CloudFlare as its one of the few DNS providers that supports SSL at the domain apex on Heroku. I wouldn't recommend using their built-in SSL solution though and it's easy to turn off.