Remove the parent’s dependency on signed answers before disabling DirectAdmin zone signing. An unsigned child can fail validation while a parent DS still expects its signing key.

Review the existing chain

Identify the exact domain, authoritative servers, current signing material and registrar/parent DS. Coordinate an active rollover or migration with the responsible DNS administrator before removing anything.

Remove the parent dependency first

1. Remove the intended DS through the registrar or parent’s supported workflow.
2. Confirm the removal is published at the parent.
3. Keep the child signed while previously cached DS data expires, using the relevant TTL and transition plan.
4. Then open the domain’s DNSSEC panel and choose Disable DNSSEC.
5. Inspect the result and verify public DNS and validation afterwards.

There is no universal fixed wait for every domain. Use actual parent state and cache lifetime, as described in DNSSEC operational practices.

Verify the intended state

The DirectAdmin disabling request removes its DNSSEC arrangement and related keys. Do not assume an ordinary record export can recreate secret signing material. Removing an unrelated DS inside another zone is not the same as removing this domain’s parent DS.

The module’s key-material status and a successful domain-list connection test are separate from public validation. If a request failed, keep the exact result and have the administrator inspect actual server state before retrying.

Keep the domain reference, original action time and redacted result while your hosting team checks the parent and child state. If parent control or the transition is unclear, resolve that responsibility before disabling signing rather than experimenting with keys.

Check the unsigned transition

Your hosting team should confirm the intended parent DS removal, its authoritative publication and the relevant cache transition with the DNS administrator before requesting unsigned service. Compare that plan with the module’s original provider-disabling result. Do not disable signing merely to diagnose a parent mismatch or rely on a fixed universal wait.

See the PD DirectAdmin DNS Blesta guide for related tasks, or explore the module.