Use PD cPanel DNS to request zone signing, then publish the corresponding DS at the registrar or parent. Signing the zone and completing the public chain of trust are separate steps.

Prepare the zone and parent

Confirm the intended zone, authoritative nameservers and registrar. cPanel DNSSEC requires a WHM server using the PowerDNS backend; the server administrator must confirm the backend, cluster readiness and token permissions. Do not use signing controls as a repair for an unrelated delegation or connection error.

Enable and publish

1. Open cPanel DNS → Zones, select the zone and open DNSSEC.
2. If the zone is not signed, choose Enable DNSSEC and inspect the result.
3. Review the current signing status and the displayed DS material.
4. Add the correct DS at the registrar or parent using its supported workflow.
5. Check the parent publication and a public validating DNS response.

A DS normally contains key tag, algorithm, digest type and digest, or can be supplied as the complete DS text where accepted. Some parents ask for DNSKEY material instead; follow their required format without confusing DNSKEY flags with DS fields.

The cPanel DNSSEC guide explains the server and parent requirements. The module’s status indicator alone does not establish that the whole chain validates.

Keep key administration separate

The WHM server manages the signing keys. A record snapshot does not preserve secret signing keys or recreate a parent trust chain. Server-side rollover and backend preparation remain the administrator’s work.

If signing is refused, retain the original redacted result while your hosting team checks the operation and backend prerequisites; do not change server configuration blindly. Use the safe disabling guide before removing signing from an already delegated signed zone.

Check signing and delegation

Your hosting team should compare the chosen zone/provider, actual signing result and current DS material with the intended authoritative nameservers and parent publication. Have your WHM administrator confirm the supported PowerDNS backend, cluster readiness and token permissions; parent DS publication belongs with the registrar or DNS administrator. A green module status is not a complete public chain-of-trust test, and a record snapshot does not preserve signing private keys.

See the PD cPanel DNS Blesta guide for related tasks, or explore the module.