ODVR

CZ.NIC ODVR are Open DNSSEC Validating Resolvers that you might freely use instead of the standard DNS resolvers offered by your Internet service provider.

What is DNS and DNSSEC?

For more information visit pages About Domains and DNS and About DNSSEC .

How to setup CZ.NIC resolvers?

Change your network configuration so that it uses resolvers with IP addresses 193.17.47.1 and 185.43.135.1. If your network connection supports the IPv6 protocol, you can also add IPv6 addresses 2001:148f:ffff::1 and 2001:148f:fffe::1.

Microsoft Windows 10

You have to change the setting of a specific network connection.

Open Control Panel
Click Network and Sharing Center and then Change the adapter settings.
Choose the connection for which you want to use CZ.NIC resolvers. To change a wired (Ethernet) connection, right-click Local network connection and select Properties. To change a wireless connection, right-click Wireless connection and select Properties.
Choose the General tab. Select Internet protocol version 4 (TCP/IPv4) in the This connection uses the following items: list and click Properties button.
In the General tab, click Advanced... and choose the DNS tab. If the listbox already contains IP addresses, write them down in case you want to return to them in the future.
Click OK.
Select Use the followinfg DNS server addresses:.
Enter the CZ.NIC resolvers' IP addresses 193.17.47.1 and 185.43.135.1 to the Preferred DNS server and Alternate DNS server fields.
Restart the connection you selected in step 3.
Check that your new CZ.NIC resolvers work correctly - open page www.odvr.cz.
Repeat the previous steps for all network connections where you want to use the CZ.NIC Open DNSSEC Validating Resolvers.

Mac OS X 10.6 and later, MacOS 10.x

In the Apple menu select System Preferences, then click Network.
If the lock icon in the bottom left corner is locked, click on it to authorize changes you will make. You have to enter your password.
Select connection for which you want to setup the CZ.NIC resolvers. For example, to change a wired network setup, select Ethernet in the list and click Advanced... To change a wireless network setup select Airport in the list and click Advanced...
Choose the DNS tab.
Click the + button and replace IP addresses already there with the CZ.NIC resolvers' IP addresses: 193.17.47.1 and 185.43.135.1.
Click OK and then Apply.
Check that your new CZ.NIC resolvers work correctly - open page www.odvr.cz.
Repeat the previous steps for all network connections where you want to use the CZ.NIC Open DNSSEC Validating Resolvers.

Linux (Network Manager)

If your Linux distribution does not use Network Manager, consult your distribution's documentation or vendor for instructions on changing DNS resolvers.

Right-click the Network Manager icon and choose Edit connections…
Select a network connection which you want to use with the CZ.NIC resolvers. For example, for a wired connection choose the Wired tab, select Auto eth0 from the list and click Edit. For a wireless connection choose the Wireless tab, select Auto from the list and click Edit.
Choose the IPv4 Settings tab. If you already have Automatic (DHCP) in the Method combobox, change it to Automatic (DHCP) addresses only.
After you have selected either Automatic (DHCP) addresses only or Manual, you can edit DNS servers field. If this field already contains IP addresses, write them down in case you want to cease using CZ.NIC resolvers in the future. Type the CZ.NIC resolvers' IP addresses into the DNS servers field, separated with commas: 193.17.47.1, 185.43.135.1.
Click Apply. You might need to enter your password, depending on your system setup.
Close the dialog windows.
Check that your new CZ.NIC resolvers work correctly - open page www.odvr.cz.
Repeat the previous steps for all network connections where you want to use the CZ.NIC Open DNSSEC Validating Resolvers.

How to turn on DNS-over-TLS (DoT)

The DoT protocol protects communication between client and DNS resolver by means of TLS encryption and listens on port TCP/853. To set DoT, you can use for example the stub resolver Stubby . There are installation packages for Linux, Windows and macOS.

First, you need to configure Stubby. You can do it in file /etc/stubby/stubby.yml on Linux or C:Program FilesStubbystubby.xml on MS Windows.

Insert configuration

resolution_type: GETDNS_RESOLUTION_STUB dnssec_return_status: GETDNS_EXTENSION_TRUE dns_transport_list: - GETDNS_TRANSPORT_TLS tls_authentication: GETDNS_AUTHENTICATION_REQUIRED tls_query_padding_blocksize: 128 edns_client_subnet_private : 1 idle_timeout: 10000 listen_addresses: - 127.0.0.1 - 0::1 round_robin_upstreams: 1 upstream_recursive_servers: #IPv4 ODVR - address_data: 193.17.47.1 tls_auth_name: "odvr.nic.cz" - address_data: 185.43.135.1 tls_auth_name: "odvr.nic.cz" #IPv6 ODVR - address_data: 2001:148f:ffff::1 tls_auth_name: "odvr.nic.cz" - address_data: 2001:148f:fffe::1 tls_auth_name: "odvr.nic.cz"

Start the Stubby service
On Linux via systemd - "systemctl start stubby“
On MS Windows so far manually from the command line - "C:Program FilesStubbystubby.exe -l“ (IT developers promise to run it as a service in the future).
Finally, you need to change the DNS resolvers in the network setting to "127.0.0.1“ or "::1“. See the previous chapters for details.

You can then verify that you are communicating with ODVR in a secure way, by means of the tcpdump tool on Linux or wireshark on Windows with an active filter "host odvr.nic.cz and port 853“

How to turn on DNS-over-HTTPS (DoH)

The DoH protocol, the same as DoT, protects communication between client and DNS resolver by means of TLS encryption, but in this case on port TCP/443. Another difference is that it is used directly in the web browser and there is no need to install and configure additional services. You can try the DoH protocol in Firefox from version 62, Chrome from version 66 or Bromite from version 67.

Setting up directly in Firefox is very simple.

Go to settings – three horizontal lines in the bar in the top right corner, select Preferences and then scroll down to the Network settings section and click the Settings button.
Check the Turn on DNS over HTTPS check-box and enter "https://odvr.nic.cz/dns-query“ into the own field.
Alternatively, it is possible to activate DoH even in the advanced settings „about:config“ by searching for a string „network.trr“.

You can then verify whether you are actually communicating with ODVR in a secure way, using the tcpdump tool on Linux or wireshark on Windows with the active filter "host odvr.nic.cz and port 443“

In Chrome (currently only on OS Windows and on Android mobile platform of certain manufacturers), you can set up using DoH on ODVR via settings:

Go to settings (three dots in the top-right corner), select Privacy and security in the left menu and then select Security to get to the Safe Browsing section.
Go to Advanced and enable the Use secure DNS option and then choose CZ.NIC ODVR from the With combo-box.

A shortcut to this setting is entering chrome://settings/security in the browser‘s address bar.

You can then verify whether you are actually communicating with ODVR in a secured way using the tcpdump tool on Linux or the Wireshark tool on Windows with active filter "host odvr.nic.cz and port 443“.

DNS-over-HTTPS supports only the HTTP/2 protocol.

FAQ

Have I set up ODVR correctly?

What benefits do I get from using CZ.NIC resolvers?

Will all my DNS queries be secured if I use CZ.NIC resolvers?

Is using CZ.NIC resolvers safe?

How is my personal information secured?

CZ.NIC temporarily processes IP addresses of devices you are using and never stores it in permanent logs. CZ.NIC stores these IP addresses only temporarily for a few minutes and then CZ.NIC deletes it permanently. CZ.NIC stores traffic captures with anonymized IP addresses. This allows CZ.NIC to improve ODVR operation and to do DNS research.

The content of the traffic captures includes, for example:

Absolute packet arrival time
Transport protocol headers from transport used to deliver the request (UDP, TCP, TLS, HTTPS etc.)
Requested domain name, e.g., www.nic.cz
Requested record type, e.g., A, AAAA, NS, MX, TXT, etc.
DNS protocol flags and bits, e.g., Checking Disabled bit, EDNS options, etc.
Full response sent to the client, e.g., SUCCESS, SERVFAIL, NXDOMAIN, IP addresses for the requested domain name (e.g., IP address of www.nic.cz) etc.
Total time taken to process the request end-to-end

The processing of personal data for this service is governed by the applicable Privacy Policy .

But open DNS resolvers are evil, are they not?

Resolver usage test

Due to the character of the test, it can take up to tens of seconds to finish.

Test results:

Start test

Running the test repeatedly can return the same results despite making changes in the settings of the router or the system (due to the browser‘s or system‘s DNS cache). Therefore, you should try to run the test using another browser or after some time.