Hello peter,
By following this introduction dnsviz will still return errors and warnings because desec unexpectedly auto add a CDS record using sha512, my domain is znn.ee and you could find detailed info at DeSEC automatically add unexpected CDS record - #2 by cjydev
Thank you