Why exactly one SOA record is non-negotiable

The Start of Authority record isn't just another entry in a zone — it's the record that declares the zone itself exists, names its primary nameserver and administrative contact, and carries the serial number secondary nameservers use to know when to refresh their copy. A zone with zero SOA records isn't a valid zone at all as far as the DNS protocol is concerned, and a zone with more than one is contradictory — there can only be one authoritative "this is what this zone is" declaration. Both conditions will cause a real nameserver to reject the zone outright, which is why this tool treats either one as a hard finding rather than a stylistic suggestion.

Why a CNAME can't share a name with anything else

RFC 1034 requires that if a name has a CNAME record, that CNAME must be the *only* record at that name — no A record, no MX, nothing else alongside it. The reasoning is that a CNAME is an alias, redirecting all queries for that name to a different name entirely; having a CNAME and, say, an MX record at the same name creates an actual contradiction about what a resolver following the chain is supposed to do. This restriction trips people up constantly at the zone apex in particular — CNAME at the root of a domain is a classic mistake, since the apex also needs SOA and NS records, which a CNAME there would conflict with directly.