This means you need to submit the DS (Delegation Signer) to your registrar. Assuming they support DNSSEC, they would then sign it and serve it, providing a complete chain of trust from root zone down to your zone.
Or, you could just not use DNSSEC. It provides no useful security that TLS doesn’t already provide for the vast majority of users. (Any service that uses TLS is already protected against MITM and spoofing and such. DNSSEC is almost certainly unnecessary complexity.)
No, I don’t have answers for those. I don’t use DNSSEC (because it provides no additional security for the stuff I do), so my experience with it is quite limited.
In case you want to understand why I’m dismissive of DNSSEC and assert it provides no useful security benefits for services that can use TLS, this article by a pretty well-known security expert covers it better than I could: Against DNSSEC — Quarrelsome
