A recursive resolver following a CNAME returns the target zone's SOA in the answer, which made findApex wrongly treat a CNAME owner as an apex. Only accept a SOA whose owner is the candidate itself.
