DNSSEC turned a working domain into SERVFAIL
After moving DNS providers, the DS record was left behind. Every user on a validating resolver — 1.1.1.1, 8.8.8.8 — got SERVFAIL.
DNSSEC chains from the root through the TLD to your zone. Any break means validating resolvers refuse to answer. They do not silently downgrade to insecure; that is the point.
dig +dnssec example.com @8.8.8.8
dig DS example.com @8.8.8.8Check status and the ad flag. SERVFAIL without ad usually means signatures.
Either configure signing at the new provider and publish the DS there, or remove the DS first (insecure but working), fix it, then re-enable. The DS record is the step everyone forgets when moving registrars.