DNSSEC validation failures for example.com — PowerDNS 4.9.17 / NSEC3 narrow mode

Hello cPanel Support,

I'm investigating DNSSEC validation failures affecting [redacted], hosted on our cPanel/WHM server.

Environment

• cPanel/WHM: 11.110.0.153

• Operating system: CentOS 7

• PowerDNS Authoritative

• Backend: BIND

• DNSSEC: NSEC3 narrow mode

Observed behaviour

Both Cloudflare (1.1.1.1) and Google Public DNS (8.8.8.8) return SERVFAIL when resolving ns1.[redacted] A.

Cloudflare reports:

failed to verify an insecure referral proof for ns1.[redacted].

Google reports:

Invalid denial of existence of ns1.[redacted]/ds

Adding +cdflag to the Cloudflare A query returns the A record, [ip address], confirming that the address can be resolved when DNSSEC validation is bypassed.

Diagnostic findings

• The parent DS record for [redacted] matches the active KSK, key tag xxxx.

• The authoritative server returns the SOA and DNSKEY RRsets with their RRSIG records.

• Direct DS queries for ns1.[redacted] return a signed NSEC3 denial proof. Both Cloudflare and Google accept this response, setting the ad flag.

• However, direct authoritative A queries for ns1.[redacted] return the A record without an RRSIG A in the response.

• The zone uses NSEC3 narrow mode, with seven iterations and a non-empty salt.

Why validating resolvers reject the NSEC3/DS denial proof during ordinary A lookups, and whether the authoritative responses or cPanel's PowerDNS/BIND DNSSEC integration are behaving as expected?

Please advise on the supported remediation. I have not changed the DNSSEC keys, parent DS record, or NSEC3 configuration while investigating.

I can provide the complete dig outputs and PowerDNS configuration details if required.