You have the same problem as this thread:
(.com and .edu run on the same DNS infrastructure.)
You're not doing anything invalid, but a corner case in the DNS protocol, and the design of the authoritative and recursive DNS servers involved, means it doesn't work.
$ dig +dnssec +norecurse +bufsize=512 @h.gtld-servers.net. rnelnet.com
; <<>> DiG 9.15.1-Ubuntu <<>> +dnssec +norecurse +bufsize @h.gtld-servers.net. rnelnet.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31734
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 10, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;rnelnet.com. IN A
;; AUTHORITY SECTION:
rnelnet.com. 172800 IN NS ns.rnelnet.com.
rnelnet.com. 172800 IN NS ns1.rnelnet.com.
rnelnet.com. 172800 IN NS ns2.rnelnet.com.
rnelnet.com. 86400 IN DS 22548 7 2 D79569FFC9B4E8FD53AD8F051BDE3D1FDF95D04B4DCBBB48101BB490 D2273058
rnelnet.com. 86400 IN DS 22548 7 1 B22B2BEC9C490E3F8471183F5C8C2B6C18E00D0E
rnelnet.com. 86400 IN DS 13689 7 2 9493945454270BA82B508B39866CCB151A911949B810699C86F627A8 E020B199
rnelnet.com. 86400 IN DS 13689 7 1 59AB2C0527E9B55B406EBBC100ED4DC4DFBF7004
rnelnet.com. 86400 IN DS 13173 7 2 D604B3BD1157166E4F406648A99E231FF5789BE8833E24BBA3AFC258 196B7EB1
rnelnet.com. 86400 IN DS 13173 7 1 073B0C4D181C90A26F2D21BA07B6811A1D7BE269
rnelnet.com. 86400 IN RRSIG DS 8 2 86400 20190816043035 20190809032035 17708 com. r+yL8SjhNyBMOc3aP7DT2VMT+l8uzC6H6zswYMVosJI99SF5k3p/OV/7 uvJlFJVNB3U+5+7SyVOfyr3sC33xt1FdgkCZfquQfJYH99rjwo5wpdzj WqH9SHDq1gh80UzQmvFn0Nvb5WeEKpYeIRBQjpqFAMXiOARLabe/caRY E6A=
;; Query time: 117 msec
;; SERVER: 2001:502:8cc::30#53(2001:502:8cc::30)
;; WHEN: Fri Aug 09 21:52:31 UTC 2019
;; MSG SIZE rcvd: 508
You can follow the same workaround as given in that thread -- delete some of your DS
or NS
records, or add even more.
I'd suggest getting rid of the SHA-1 DS
records. They're useless for most purposes.
Edit: You could also use DNS servers in a different domain or TLD.
(P.S.: It's not invalid, but your DNSKEY
response is huge. You should consider deleting some of them, or using a DNS server that doesn't sign with ZSKs, or using smaller keys, or using ECDSA.)
(P.P.S.: .com is going to start using a bigger ZSK soon. That might inadvertently solve your problem; I haven't done the math to check, though.)