In DNSSEC, the role of the root and intermediate nameservers are to provide a chain of trust until an authoritative nameserver for your zone is reached. Aside from hosting the public DS
key associated with your signed zone, they have no role in NSEC3 validation.
For NSEC3 to function, you need to sign your zone using an algorithm that mandates support for the feature. Older algorithms are supported via variants that contain a -NSEC3-
identifier. Resolvers will not attempt to utilize the newer functionality unless the support is advertised in this fashion. If the zone has been signed correctly, all you should need to do is follow the usual steps for getting the DS
key digest published to the nameserver immediately before yours in the delegation chain.
From RFC5155:
In order to aid deployment, this specification uses a signaling
technique to prevent NSEC3-unaware resolvers from attempting to
validate responses from NSEC3-signed zones.
This specification allocates two new DNSKEY algorithm identifiers for
this purpose. Algorithm 6, DSA-NSEC3-SHA1 is an alias for algorithm
3, DSA. Algorithm 7, RSASHA1-NSEC3-SHA1 is an alias for algorithm 5,
RSASHA1. These are not new algorithms, they are additional
identifiers for the existing algorithms.
Zones signed according to this specification MUST only use these
algorithm identifiers for their DNSKEY RRs. Because these new
identifiers will be unknown algorithms to existing, NSEC3-unaware
resolvers, those resolvers will then treat responses from the NSEC3
signed zone as insecure, as detailed in Section 5.2 of [RFC4035].