A domain that suddenly returns SERVFAIL after a DNSSEC or nameserver change may have a broken chain of trust.
Common causes
- The registrar still publishes a DS record for an old DNSSEC key.
- The authoritative nameservers no longer have the key referenced by the parent DS record.
- A key was deleted in cPanel before the registrar DS record was removed and allowed to expire from caches.
- DNS was moved to nameservers that do not serve the expected signed zone.
Compare the DS record published by the parent/registrar with the DNSKEY/DS information shown by the current authoritative DNS. If DNSSEC must be disabled, remove the registrar DS first and allow it to propagate before deleting the server-side key.
