How to have a CNAME record and TXT record for the same domain?

Question

When configuring a Google Site on a custom domain, the instructions provided by Google specify to create two records for the domain - a TXT and CNAME record. The TXT record contains a code that Google users to verify domain ownership before allowing users to register that domain as the site address.

Also, the instructions say to keep the TXT record for verification purposes.

From what I understand concurrent CNAME and TXT records for the same address isn't officially allowed, but testing this with Cloudflare I can see that it's possible to have concurrent TXT and CNAME records for the same domain. Presumably this is the same for other DNS management services since Google Sites is very popular and I imagine that Google Site CNAME entries are handled quite frequently across the world.

However I was recently working with a network support team to register a Google Site where the CNAME and TXT record were seemingly NOT allowed to co-exist. When both a CNAME and TXT record were present for the same domain, the software threw a configuration error (Name Server Daemon - or at least I think it was this software since the command was nsd).

Am I correct in my observation that the nsd software doesn't support the requirement of simultaneous TXT CNAME records for the same domain? And, if so, how do other DNS management services such as Cloudflare allow for this?

== Edit ==

As requested in the comments here is a screenshot of the Google Sites verification request

Answer 1

It is defined at the protocol level that (RFC 2181, 10.1):

An alias name (label of a CNAME record) may, if DNSSEC is in use, have SIG, NXT, and KEY RRs, but may have no other data. That is, for any label in the DNS (any domain name) exactly one of the following is true:

• one CNAME record exists, optionally accompanied by SIG, NXT, and KEY RRs,
• one or more records exist, none being CNAME records,
• the name exists, but has no associated RRs of any type,
• the name does not exist at all.

If any implementation does something else it is against the protocol.

One way to circumvent this would be adding the TXT record on the target of the CNAME record:

something.example.com. IN CNAME canonical.example.com.
canonical.example.com. IN TXT   "google-site-verification=*****"

Answer 2

Take a look at RFC 1034 DOMAIN NAMES - CONCEPTS AND FACILITIES, Section 3.6.2

If a CNAME RR is present at a node, no other data should be
present;

and

RFC 1920 Common DNS Operational and Configuration Errors, Section 2.4

A CNAME record is not allowed to coexist with any other data.

There is an exception when DNSSEC is in use (RFC 2181 Clarifications to the DNS Specification, Section 10.1 and RFC 4035 Protocol Modifications for the DNS Security Extensions, Section 2.5).

An alias name (label of a CNAME record) may,
if DNSSEC is in use, have SIG, NXT, and KEY RRs, but may have no
other data.