{"id":449,"date":"2026-09-07T17:35:00","date_gmt":"2026-09-07T15:35:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/?p=449"},"modified":"2026-08-31T14:46:34","modified_gmt":"2026-08-31T12:46:34","slug":"infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/","title":{"rendered":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC"},"content":{"rendered":"\r\n<p class=\"wp-block-paragraph\">Poleganie na zewn\u0119trznych, publicznych serwerach DNS (takich jak 8.8.8.8 czy 1.1.1.1) wi\u0105\u017ce si\u0119 z konieczno\u015bci\u0105 przekazywania pe\u0142nych metadanych o aktywno\u015bci sieciowej podmiotom trzecim. Nawet w przypadku stosowania szyfrowania transportowego, centralni dostawcy DNS maj\u0105 mo\u017cliwo\u015b\u0107 rejestrowania zapyta\u0144 i profilowania ruchu. Wdro\u017cenie architektury Zero-Trust DNS poprzez po\u0142\u0105czenie systemu Pi-hole z lokalnym, rekursywnym serwerem weryfikuj\u0105cym Unbound ca\u0142kowicie eliminuje zale\u017cno\u015b\u0107 od operator\u00f3w zewn\u0119trznych. Samodzielne odpytywanie serwer\u00f3w pierwiastkowych (Root Servers) z jednoczesn\u0105 walidacj\u0105 DNSSEC gwarantuje integralno\u015b\u0107 kryptograficzn\u0105, chroni\u0105c sie\u0107 przed fa\u0142szowaniem pami\u0119ci podr\u0119cznej (cache poisoning) oraz pods\u0142uchem i manipulacj\u0105 ze strony dostawcy Internetu.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">1. Za\u0142o\u017cenia architektoniczne: Zero-Trust DNS i rekursja<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">W standardowej konfiguracji sieciowej zapytania DNS s\u0105 przesy\u0142ane dalej do operatora ISP lub publicznego resolwera. Lokalna architektura Zero-Trust rozdziela to zadanie na dwa odr\u0119bne etapy:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Pi-hole (DNS Sinkhole i modu\u0142 filtruj\u0105cy):<\/strong> Przechwytuje zapytania z urz\u0105dze\u0144 lokalnych, blokuj\u0105c ruch telemetryczny, reklamy i domeny z\u0142o\u015bliwe na podstawie czarnych list.<\/li>\r\n<li><strong>Unbound (Serwer rekursywny i walidator):<\/strong> Otrzymuje prawid\u0142owe zapytania od Pi-hole i samodzielnie przechodzi przez hierarchi\u0119 DNS (Root Servers &rarr; TLD Servers &rarr; Serwery autorytatywne). Ka\u017cda odpowied\u017a jest sprawdzana pod k\u0105tem kryptograficznych podpis\u00f3w DNSSEC przed zapisaniem w lokalnej pami\u0119ci podr\u0119cznej.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<figure class=\"lw-diagram\">\n<img loading=\"lazy\" src=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/diagrams\/dns-zero-trust-unbound-pihole-pl.png\" width=\"1120\" height=\"560\" decoding=\"async\"\n     alt=\"\u015acie\u017cka DNS od klient\u00f3w lokalnych przez Pi-hole i Unbound do serwer\u00f3w root, z sinkhole dla zablokowanych domen i walidacj\u0105 DNSSEC\">\n<figcaption>Dwa etapy zamiast jednego upstreamu: Pi-hole filtruje, Unbound rozwi\u0105zuje reszt\u0119 samodzielnie od serwer\u00f3w root. \u017badna strona trzecia nie widzi pe\u0142nej historii zapyta\u0144, a DNSSEC zabezpiecza ka\u017cd\u0105 odpowied\u017a.<\/figcaption>\n<\/figure>\n\n<h2 class=\"wp-block-heading\">2. Instalacja i utwardzanie serwera Unbound krok po kroku<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">W celu skonfigurowania serwera Unbound jako wysoko zabezpieczonego resolwera rekursywnego na systemie Linux (np. Debian lub Raspberry Pi OS), nale\u017cy zrealizowa\u0107 poni\u017csz\u0105 procedur\u0119:<\/p>\r\n\r\n\r\n\r\n<ol class=\"wp-block-list\">\r\n<li><strong>Instalacja pakiet\u00f3w:<\/strong> Instalacja serwera DNS i narz\u0119dzi kryptograficznych:\r\n    <br><code>sudo apt update &amp;&amp; sudo apt install unbound unbound-anchor -y<\/code>\r\n<\/li>\r\n<li><strong>Konfiguracja kotwicy zaufania DNSSEC:<\/strong> Pobranie oficjalnego klucza g\u0142\u00f3wnego (Root Key) do weryfikacji podpis\u00f3w:\r\n    <br><code>sudo unbound-anchor -a \/var\/lib\/unbound\/root.key<\/code>\r\n<\/li>\r\n<li><strong>Tworzenie pliku konfiguracyjnego:<\/strong> Utworzenie pliku <code>\/etc\/unbound\/unbound.conf.d\/pi-hole.conf<\/code> ze zoptymalizowanymi parametrami bezpiecze\u0144stwa i prywatno\u015bci:\r\n    <pre class=\"wp-block-code\"><code>server:\r\n    verbosity: 1\r\n    interface: 127.0.0.1\r\n    port: 5335\r\n    do-ip4: yes\r\n    do-udp: yes\r\n    do-tcp: yes\r\n\r\n    # Bezpiecze\u0144stwo i walidacja DNSSEC\r\n    auto-trust-anchor-file: \"\/var\/lib\/unbound\/root.key\"\r\n    harden-glue: yes\r\n    harden-dnssec-stripped: yes\r\n    use-caps-for-id: no\r\n    edns-buffer-size: 1232\r\n    prefetch: yes\r\n    num-threads: 1\r\n\r\n    # Ochrona prywatno\u015bci (Minimalizacja ujawnianych danych)\r\n    qname-minimisation: yes\r\n    hide-identity: yes\r\n    hide-version: yes\r\n    private-address: 10.0.0.0\/8\r\n    private-address: 172.16.0.0\/12\r\n    private-address: 192.168.0.0\/16<\/code><\/pre>\r\n<\/li>\r\n<li><strong>Restart us\u0142ugi i weryfikacja dzia\u0142ania:<\/strong> Uruchomienie daemona Unbound i przetestowanie walidacji DNSSEC na zdefiniowanym porcie lokalnym:\r\n    <br><code>sudo systemctl restart unbound<\/code>\r\n    <br><code>dig @127.0.0.1 -p 5335 dnssec-failed.org +dnssec<\/code> (Zapytanie musi zwr\u00f3ci\u0107 status <code>SERVFAIL<\/code> w wyniku b\u0142\u0119dnego podpisu DNSSEC).\r\n<\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">3. Integracja z Pi-hole i opcjonalny tunel DoH krok po kroku<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Po poprawnym uruchomieniu rekursji lokalnej, system Pi-hole musi zosta\u0107 przekierowany wy\u0142\u0105cznie na serwer Unbound:<\/p>\r\n\r\n\r\n\r\n<ol class=\"wp-block-list\">\r\n<li><strong>Konfiguracja serwera nadrz\u0119dnego w Pi-hole:<\/strong> Otwarcie panelu administracyjnego Pi-hole i przej\u015bcie do zak\u0142adki <code>Settings &gt; DNS<\/code>.<\/li>\r\n<li><strong>Wy\u0142\u0105czenie zewn\u0119trznych dostawc\u00f3w:<\/strong> Odznaczenie wszystkich domy\u015blnych zewn\u0119trznych serwer\u00f3w DNS (np. Google, Cloudflare, Quad9).<\/li>\r\n<li><strong>Wskazanie lokalnego serwera Upstream:<\/strong> W polu <code>Custom 1 (IPv4)<\/code> nale\u017cy wpisa\u0107 lokalne gniazdo Unbound: <code>127.0.0.1#5335<\/code>.<\/li>\r\n<li><strong>W\u0142\u0105czenie obs\u0142ugi DNSSEC:<\/strong> Zaznaczenie opcji <code>Use DNSSEC<\/code>, aby Pi-hole prawid\u0142owo przekazywa\u0142 flagi walidacji kryptograficznej do klient\u00f3w w sieci lokalnej.<\/li>\r\n<li><strong>Opcjonalne szyfrowanie DNS-over-HTTPS (DoH):<\/strong> W \u015brodowiskach sieciowych nara\u017conych na inspekcj\u0119 pakiet\u00f3w na porcie 53 przez ISP, serwer Unbound da si\u0119 skonfigurowa\u0107 do kierowania ruchu przez lokalny proxy DoH (np. <code>cloudflared<\/code> lub <code>dnscrypt-proxy<\/code>), co zapewnia pe\u0142ne szyfrowanie TLS w sieciach tranzytowych.<\/li>\r\n<\/ol>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">4. Podsumowanie i warto\u015b\u0107 architektoniczna<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\"><strong>Co da si\u0119 osi\u0105gn\u0105\u0107 dzi\u0119ki temu poradnikowi:<\/strong> Wdro\u017cenie niezale\u017cnej architektury Zero-Trust DNS, \u0142\u0105cz\u0105cej filtrowanie reklam i zagro\u017ce\u0144 w Pi-hole z bezpo\u015bredni\u0105 rekursj\u0105, minimalizacj\u0105 zapyta\u0144 i walidacj\u0105 kryptograficzn\u0105 DNSSEC w serwerze Unbound.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\"><strong>Wynikaj\u0105ca z tego warto\u015b\u0107:<\/strong> Uzyskana zostaje pe\u0142na niezale\u017cno\u015b\u0107 od komercyjnych dostawc\u00f3w DNS, co uniemo\u017cliwia podmiotom trzecim profilowanie oraz monetyzacj\u0119 historii przegl\u0105dania sieci lokalnej. Walidacja DNSSEC skutecznie zabezpiecza urz\u0105dzenia przed atakami typu cache poisoning, spoofing i Man-in-the-Middle, a mechanizm QNAME minimisation sprawia, \u017ce do serwer\u00f3w nadrz\u0119dnych wysy\u0142ane jest wy\u0142\u0105cznie absolutne minimum informacji niezb\u0119dnych do ustalenia adresu docelowego.<\/p>\r\n\n\n<div class=\"lw-quellen\">\n<h2>\u0179r\u00f3d\u0142a<\/h2>\n<ul>\n<li><a href=\"https:\/\/docs.pi-hole.net\/\" target=\"_blank\" rel=\"noopener noreferrer\">Pi-hole documentation<\/a><\/li>\n<\/ul>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Techniczny przewodnik krok po kroku po konfiguracji suwerennej infrastruktury Zero-Trust DNS przy u\u017cyciu Pi-hole i Unbound z walidacj\u0105 DNSSEC.<\/p>\n","protected":false},"author":1,"featured_media":14009,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[141],"tags":[92151,92475,92373,92478,92226,92238],"class_list":["post-449","post","type-post","status-publish","format-standard","hentry","category-tutorials-pl-it-networks-pl","tag-prywatnosc-danych-pl-pl","tag-dns-pl","tag-network-security-pl","tag-pi-hole-pl","tag-self-hosting-pl","tag-tutorial-pl"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC - Lukas Wojcik - Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC - Lukas Wojcik - Blog\" \/>\n<meta property=\"og:description\" content=\"Techniczny przewodnik krok po kroku po konfiguracji suwerennej infrastruktury Zero-Trust DNS przy u\u017cyciu Pi-hole i Unbound z walidacj\u0105 DNSSEC.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/\" \/>\n<meta property=\"og:site_name\" content=\"Lukas Wojcik - Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-07T15:35:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"luky\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"luky\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/\"},\"author\":{\"name\":\"luky\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"headline\":\"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC\",\"datePublished\":\"2026-09-07T15:35:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/\"},\"wordCount\":601,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png\",\"keywords\":[\"Data Privacy\",\"DNS\",\"Network Security\",\"Pi-hole\",\"Self-Hosting\",\"Tutorial\"],\"articleSection\":[\"Tutorials\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/\",\"name\":\"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC - Lukas Wojcik - Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png\",\"datePublished\":\"2026-09-07T15:35:00+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png\",\"width\":1200,\"height\":630,\"caption\":\"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/pl\\\/it-networks-pl\\\/tutorials-pl-it-networks-pl\\\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/\",\"name\":\"Lukas Wojcik - Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/#\\\/schema\\\/person\\\/895f7604f9b6b71aad9bba33af28d0f9\",\"name\":\"luky\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"contentUrl\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\",\"width\":424,\"height\":636,\"caption\":\"luky\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/lw-x2.jpg\"},\"sameAs\":[\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\"],\"url\":\"https:\\\/\\\/www.lukaswojcik.com\\\/blog\\\/author\\\/luky\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC - Lukas Wojcik - Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/","og_locale":"en_US","og_type":"article","og_title":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC - Lukas Wojcik - Blog","og_description":"Techniczny przewodnik krok po kroku po konfiguracji suwerennej infrastruktury Zero-Trust DNS przy u\u017cyciu Pi-hole i Unbound z walidacj\u0105 DNSSEC.","og_url":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/","og_site_name":"Lukas Wojcik - Blog","article_published_time":"2026-09-07T15:35:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png","type":"image\/png"}],"author":"luky","twitter_card":"summary_large_image","twitter_misc":{"Written by":"luky","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#article","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/"},"author":{"name":"luky","@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"headline":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC","datePublished":"2026-09-07T15:35:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/"},"wordCount":601,"commentCount":0,"publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png","keywords":["Data Privacy","DNS","Network Security","Pi-hole","Self-Hosting","Tutorial"],"articleSection":["Tutorials"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/","url":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/","name":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC - Lukas Wojcik - Blog","isPartOf":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#primaryimage"},"image":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#primaryimage"},"thumbnailUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png","datePublished":"2026-09-07T15:35:00+00:00","breadcrumb":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#primaryimage","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/09\/hero-449-infrastruktura-zero-trust-dns-unboun-g.png","width":1200,"height":630,"caption":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC"},{"@type":"BreadcrumbList","@id":"https:\/\/www.lukaswojcik.com\/blog\/pl\/it-networks-pl\/tutorials-pl-it-networks-pl\/infrastruktura-zero-trust-dns-unbound-pi-hole-dnssec-pl\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.lukaswojcik.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Infrastruktura Zero-Trust DNS: Unbound i Pi-hole z DoH oraz DNSSEC"}]},{"@type":"WebSite","@id":"https:\/\/www.lukaswojcik.com\/blog\/#website","url":"https:\/\/www.lukaswojcik.com\/blog\/","name":"Lukas Wojcik - Blog","description":"","publisher":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.lukaswojcik.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.lukaswojcik.com\/blog\/#\/schema\/person\/895f7604f9b6b71aad9bba33af28d0f9","name":"luky","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","url":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","contentUrl":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg","width":424,"height":636,"caption":"luky"},"logo":{"@id":"https:\/\/www.lukaswojcik.com\/blog\/wp-content\/uploads\/2026\/07\/lw-x2.jpg"},"sameAs":["https:\/\/www.lukaswojcik.com\/blog"],"url":"https:\/\/www.lukaswojcik.com\/blog\/author\/luky\/"}]}},"_links":{"self":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/comments?post=449"}],"version-history":[{"count":4,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/449\/revisions"}],"predecessor-version":[{"id":13336,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/posts\/449\/revisions\/13336"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media\/14009"}],"wp:attachment":[{"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/media?parent=449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/categories?post=449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lukaswojcik.com\/blog\/wp-json\/wp\/v2\/tags?post=449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}