Certification
CZ.NIC has developed and operates the .CZ Registrar Certification Program to provide an overview of the quality of services offered by individual registrars.
About the project
CZ.NIC has been developing and operating the .CZ Registrar Certification Program since 2011 with the following main objectives:
to provide prospective .CZ domain registrants with information about the quality and level of services offered by individual registrars
to help registrars design their systems in a way that makes them as user-friendly as possible for end customers
to promote the use of the MojeID service, particularly as a means of electronic identification that can be used to access public administration services (through the integration of MojeID with the National Identity Authority – NIA) and to help meet the requirements of the Cybersecurity Act in connection with the implementation of the new EU NIS2 Directive
In 2024 and 2025, the entire certification program was revised to reflect current requirements. Among other things, the new program takes into account the use of modern technologies, adequate security measures, and an expanded portfolio of complementary services such as:
higher security standards
availability of a certified specialist trained at the CZ.NIC Academy in .CZ domain-related matters
offer of wholesale services and more
Participation guidelines
Participation in the certification process is entirely voluntary. A registrar may apply for certification at any time during the year. Following a successful evaluation, the registrar is awarded the "Certified .CZ registrar" certificate, together with the corresponding rating and certification mark (logo), valid for a period of 12 months.
As part of the application process, the registrar must provide CZ.NIC with the necessary URLs and IP addresses for the main website, the order form, and the customer administration panel. If multiple platforms are used, these details must be provided for all of them, as all platforms will be subject to testing.
All platforms used by end customers, as well as any additional platforms to which customers may be automatically redirected, must meet the entry requirements. The final score will be determined based on the lowest result achieved among the tested platforms.
The registrar is required to report any changes without undue delay, such as upgrades to the registration system or changes to the range of services offered. Failure to report such changes may result in the certification being withdrawn.
Each registrar may apply for re-evaluation once during the one-year certification period.Entry requirements
Registrars must meet all of the following requirements in order to undergo the evaluation process:
the registrar complies with the conditions of the Registration and Domain Name Administration Agreement
the registrar allows customers to edit existing objects in the registry (e.g. domain details, contacts, NSSETs, and KeySets)
the registrar supports the MojeID service, which can be used both for registration and for logging in to the registrar's system in accordance with the defined rules
the registrar has filed its financial statements in the public register. (For the assessed period, this always means one year in arrears; for example, in 2024, the financial statements for 2022 should be available.)
the registrar's main domain, order form, and customer administration panel must be accessible over IPv6. In addition, the domain must have redundant IPv6 NS records, DNSSEC enabled, and SSL with a minimum SSL Labs rating of B
Evaluation process and criteria
How the evaluation process works
For the certification process, CZ.NIC relies on the services and expertise of APEK (the Czech Association for Electronic Commerce). The evaluation criteria are divided into several sections, each of which must achieve a score of at least 50%.
The evaluation process consists of two stages. The first stage is conducted in accordance with the testing methodology described in detail in the criteria document. The registrar is then informed of the results and may submit comments on the evaluation.
In the second stage of the evaluation process, only those criteria that have been commented on by the registrar are reviewed.
Criteria for registrar evaluation
The evaluation primarily focuses on the registrar's registration system, which is understood to include:
functionality of the web application for .CZ domain registration
security
customer support
additional services
The complete list of criteria is available for download here (Czech only):
Conditions for obtaining the "Supported" status in the table
In addition to the certification itself, the registrar list includes several separate indicators providing information about specific services supported by registrars. Registrars may obtain these indicators by meeting the defined requirements, even if they do not participate in the certification program.
MojeID
The registrar supports the use of the MojeID service, specifically:
registration of new customers
customer login to the registrar's system
authorization of changes for validated contacts or contacts linked to the National Identity Authority (NIA). Preferably, the registrar should also offer preferential terms or special offers for users authenticated via NIA (for example, when transferring a domain name between two contacts verified at least at the "substantial" level of assurance, no additional contact verification is required)
The MojeID implementation must be based exclusively on the OpenID Connect or SAML protocols in accordance with the specifications set out in the technical documentation.
DNSSEC
the registrar's main domain, order form, and customer administration panel are secured using DNSSEC
the registrar offers DNSSEC to customers on its website (the service does not have to be provided free of charge or to all customers; offering it as part of a specific program is also positively evaluated)
at least 1% of the domains for which the registrar acts as the designated registrar are secured using DNSSEC (i.e. they have an assigned KeySet)
DNSSEC is enabled by default when registering a new .CZ domain
IPv6
the main domain, order form, and customer administration panel are accessible from IPv6-only networks, including DNS resolution
IPv6 is configured by default on the name servers (including redundancy) used when registering a new domain
the registrar allows customers to assign an IPv6 address to a GLUE record and has at least two such records in the registry
Domain guru
the registrar has at least one certified specialist in its support team who has been trained at the CZ.NIC Academy in matters related to .CZ domains
Wholesale services
the registrar also offers wholesale services
DNS hosting
it is offered as a default service
it supports IPv6
DNSSEC is turned on for customers by default
the DNS servers are redundant (at least two servers)
Domain auctions
the registrar must be included in the official list of supported registrars on the Domain Auctions website (aukce.nic.cz ) and operate its own landing page focused on auction support
Evaluation results
The number of stars awarded depends on the total number of points achieved, as follows:
The final result – the percentage of points achieved, the number of stars awarded, the "Certified .CZ Registrar" designation, and a link to the detailed evaluation report – is provided to the registrar and is also published in the list of registrars .
Registrars are ranked in descending order according to the percentage of points achieved. The certification result is supplemented by selected individual criteria marked as "supported" or "not supported" (displayed graphically in the table). Registrars with the same score are randomly rotated whenever the table is reloaded.
The “Certified .CZ registrar” mark
The mark includes the "Certified .CZ registrar" logo and the rating represented by stars. Registrars authorized to use the mark may include it in their marketing and PR communications.