diff --git a/dns/dns-saas-service-detection.yaml b/dns/dns-saas-service-detection.yaml
index 22148b690e..466d5915d4 100644
--- a/dns/dns-saas-service-detection.yaml
+++ b/dns/dns-saas-service-detection.yaml
@@ -392,3 +392,4 @@ dns:
       - type: word
         words:
           - "IN\tCNAME"
+          - "IN\\s*CNAME"