DNSSEC must be removed in the correct order to avoid SERVFAIL responses.
- At the domain registrar, remove or disable the DS record for the domain.
- Allow the DS change to propagate. cPanel's current Zone Editor documentation advises waiting at least 24 hours before deleting the cPanel DNSSEC key.
- After the registrar DS record is no longer active, return to cPanel → Zone Editor → DNSSEC.
- Delete or deactivate the old DNSSEC key as appropriate.
Do not delete the signing key first while the parent DS record still points to it. That creates a broken DNSSEC chain and can make validating resolvers return SERVFAIL.
