DNSSEC validation depends on the DNSKEY information served by the authoritative DNS system matching the DS record published through the registrar. A mismatch can cause validating resolvers to return SERVFAIL.
- Check whether DNSSEC is enabled for the domain.
- Compare the active DNSSEC key/DS information with the DS record at the registrar.
- If a server or DNS provider was changed without updating the registrar DS record, correct the DS chain using the current DNS provider’s key information.
- When disabling DNSSEC, remove or disable the registrar DS record before deleting the DNSSEC key, following cPanel’s documented sequence.
- Allow DNS changes to propagate before deleting the old key material.
cPanel specifically warns that stale DS records after a transfer can create DNS resolution failures.
