After removing DS records and disabling DNSSEC for a Cloud DNS zone, DNSSEC-validating resolvers still cannot resolve the zone. What should you do?

Even after removing DS records and disabling DNSSEC in Cloud DNS, DNSSEC-validating resolvers might still be trying to validate the zone if your domain registrar still advertises DNSSEC for your domain. The registrar holds the authoritative DS records in the parent zone (e.g., .com, .org), which resolvers use to establish a chain of trust. You must explicitly disable DNSSEC at your domain registrar to remove these DS records from the parent zone. Until this is done, resolvers will continue to see the old DS records and fail validation, preventing resolution. Updating the TTL or setting the zone to TRANSFER state will not address the DNSSEC validation failure at the registrar level. Transferring ownership is an unnecessary and drastic step.