Complete procedures with a way back.

Build a private, cache-enabled Unbound resolver that performs recursion itself, validates DNSSEC, minimizes query names, and refuses clients outside an explicit network.

Layer Pi-hole v6 filtering on a client-facing DNS service and Unbound validation on a loopback-only recursive port, with explicit privacy, firewall, DNSSEC, canary, and rollback controls.

Publish a public zone from a recursion-disabled BIND 9 primary, transfer it only to approved secondaries, sign it with an explicit DNSSEC policy, submit the DS record to the parent, and prove delegation over UDP and TCP from outside the network.

Migrate a production zone safely, enforce Full (strict), protect the origin with mTLS and network controls, cache only proven public content, stage WAF and rate limiting by plan, enable DNSSEC, and rehearse recovery.

Diagnose Certbot AuthorizationError and failed ACME challenges without retrying blindly. Separate public DNS, IPv6, HTTP-01 routing, redirects, CAA, DNSSEC, DNS-01 propagation, and multi-origin failures before issuing or renewing a certificate.