Currently, WebUI offers NSEC3PARAM under "DNS Resource Records" tab. This record type can be present only at zone apex and nowhere else.
For this reason it should go to DNS zone->"Settings" tab (the situation is the same as e.g. with "SOA serial").
Discussed offline, this needs to be solved in 4.0. Changes that needs to be done:
Metadata Update from @pspacek:
- Issue assigned to mbasti
- Issue set to the milestone: FreeIPA 4.0 GA
to comment on this ticket.