You are disabling DNSSEC for one of your Cloud DNS-managed zones. You removed the DS records from your zone file, waited for them to expire from the cache, and disabled DNSSEC for the zone. You receive reports that DNSSEC validating resolves are unable to resolve names in your zone. What should you do? 

Answer options:

A. Update the TTL for the zone. 
B. Set the zone to the TRANSFER state. 
C. Disable DNSSEC at your domain registrar.
D. Transfer ownership of the domain to a new registrar.

C

Before disabling DNSSEC for a managed zone you want to use, you must deactivate DNSSEC at your domain registrar to ensure that DNSSEC-validating resolvers can still resolve names in the zone. Reference: https://cloud.google.com/dns/docs/dnssec-config