As you might have guessed, DNSSEC signed zones are not AXFR’ed from cPanel servers (agents) to your slave DNS servers (nodes) out of the box.
This is because cPanel narrow signs the DNSSEC enabled zones which prohibits zone transfers.
For DNSSEC to work with cPanel and external DNS servers, the zone must not be narrow signed.
Disable DNSSEC (if enabled) with:
uapi --user=<cpanel_user> DNSSEC disable_dnssec domain=<domain>
Enable DNSSEC for domain (narrow mode 0):
pdnsutil set-nsec3 <domain> '1 0 1 -' pdnsutil secure-zone <domain> pdnsutil rectify-zone <domain>
Verify narrow mode is 0:
uapi --user=<cpanel_user> DNSSEC fetch_ds_records domain=<domain> | grep narrow
Go to your registar’s panel and fill the DNSSEC form with the new values from cPanel > Zone Editor > DNSSEC
