Please add a loop in validate-domains section for each domain to check if the 'Nameserver records returned by the parent servers' (root ns records) match 'NS records listed the domain on virtualmin' and there is no any Stealth NS records.
This will help a lot finding NS issues.
See this IntoDNS.com example : http://intodns.com/sibtayn.org
The parent name servers doesn't match ns records listed on the domain records. Or this one :
This domain has Stealth NS records which is not good ( NS records listed in domain's name server but not in the parent server or root ns records ).