Plan parent DS removal before turning off signing in PD cPanel DNS. A parent that still expects signed answers can make an unsigned child fail validation.

Review the current trust chain

Identify the authoritative zone, registrar or parent, current DS and signing state. Confirm who can change the parent. If a move or rollover is in progress, coordinate with the DNS administrator rather than removing keys as an experiment.

Remove the dependency first

1. Remove the intended DS through the registrar or parent workflow.
2. Confirm the parent has published the removal.
3. Keep the child signed while previously cached DS data expires, using the relevant TTL and administrator’s transition plan.
4. Only then open the zone’s DNSSEC panel and choose Disable DNSSEC.
5. Inspect the result and verify public DNS after the change.

The DNSSEC operational guidance warns that leaving a parent DS while going unsigned makes the zone fail validation. There is no universal fixed wait that fits every zone; use the actual parent TTL and state.

Check the intended result

The disable control requests the provider’s DNSSEC disabling operation. Do not assume an ordinary BIND export can recover those keys. Removing one ordinary DS record inside an unrelated zone is not the same as removing this zone’s parent DS.

Check authoritative answers and public validation separately from the provider connection. If the parent state or transition is unclear, preserve the zone and review the plan with your DNS administrator before disabling. Use the enabling guide for the opposite procedure.

Only use this workflow on a server whose DNSSEC operation is supported. Customer controls are also subject to locks and the domain-only access policy. Keep key management and any cluster synchronisation with the WHM administrator.

Check the unsigned transition

Your hosting team should confirm the intended parent DS removal, its authoritative publication and the relevant cache transition with the DNS administrator before requesting unsigned service. Compare that plan with the module’s original provider-disabling result. Do not disable signing merely to diagnose a parent mismatch or rely on a fixed universal wait.

See the PD cPanel DNS Blesta guide for related tasks, or explore the module.