diff --git a/apex.go b/apex.go
index 354b157..a5e7f1a 100644
--- a/apex.go
+++ b/apex.go
@@ -13,7 +13,9 @@ func (gw *Gateway) serveApex(state request.Request) (int, error) {
 	m.SetReply(state.Req)
 	switch state.QType() {
 	case dns.TypeSOA:
+		m.Authoritative = true // For some reason this flag is not set on the first non-cached response ?
 		m.Answer = []dns.RR{gw.soa(state)}
+		m.Ns = []dns.RR{gw.ns(state)} // This fixes some of the picky DNS resolvers
 	case dns.TypeNS:
 		m.Answer = []dns.RR{gw.ns(state)}
 
diff --git a/setup.go b/setup.go
index 8c3c99a..62c5101 100644
--- a/setup.go
+++ b/setup.go
@@ -79,6 +79,12 @@ func parse(c *caddy.Controller) (*Gateway, error) {
 					return nil, c.Errf("ttl must be in range [0, 3600]: %d", t)
 				}
 				gw.ttlLow = uint32(t)
+			case "apex":
+				args := c.RemainingArgs()
+				if len(args) == 0 {
+					return nil, c.ArgErr()
+				}
+				gw.apex = args[0]
 			default:
 				return nil, c.Errf("Unknown property '%s'", c.Val())
 			}