For DNS specifically, CNAME responses applying for the whole domain name instead of a specific record type was definitely a mistake in hindsight. It's just because of that decision that we can't have CNAMEs at the apex, which definitely is in the way in a bunch of situations.