Comment by delogos

Per RFCs, "example.com" (the bare domain name) must be a DNS A/AAAA record and cannot be a CNAME, which could limit your ability to use some anti-ddos/geo-loadbalancing solutions. Subdomain names (app.example.com) can be CNAME records.