Custom domain verification: cannot set CNAME in Google Cloud DNS for tenant

I recently upgraded to be able to use custom domains.

My app is hosted on Google Kubernetes and uses Cloud DNS.

In the “Tenant Settings” page, the domain setting (which is the root, like “example.com”) cannot be edited (grayed out). But, I cannot set the root domain for a CNAME record in Google Cloud DNS, but must use a sub domain (like “sub.example.com”).

How can I get my custom domain verified?

Any help appreciated!