I tried putting the contract setting to YES with zero subdomains and WITH permission to change the DNS records, but when I save it resets it to NO subdomains (without permission to edit the DNS records). I think it should be possible to give DNS customisation permission without subdomains for when you want to manipulate the main domain.
btw. It would be handy when a reseller or the admin were allowed to customize the individual DNS records without needing to give that permission to the end user. The end user TAB seems to be the only way to manipulate DNS records and that while it is may be an advanced feature only meant for resellers and admins.
