Open DNSSEC Validating Resolvers

What is the CZ.NIC ODVR?

CZ.NIC ODVR are Open DNSSEC Validating Resolvers that you might freely use instead of the standard DNS resolvers offered by your Internet service provider.

What is DNS and DNSSEC

For more information visit pages About Domains and DNS and About DNSSEC.

How to setup CZ.NIC resolvers?

Change your network configuration so that it uses resolvers with IP addresses 193.17.47.1 and 185.43.135.1. If your network connection supports the IPv6 protocol, you can also add IPv6 addresses 2001:148f:ffff::1 and 2001:148f:fffe::1.

Microsoft Windows 11

You have to change the setting of a specific network connection.

  1. Open Control Panel.
  2. Click Network and Internet.
  3. Click Network and Sharing Center.
  4. Click Change adapter settings
  5. With your right mouse button click the network connection for which you want to set CZ.NIC resolvers and click Properties.
  6. In the Networking tab go to the This connection uses the following items table.
  7. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
  8. Click Advanced and go to the DNS tab. If IP addresses are listed, save them for future (in case you want to stop using CZ.NIC resolvers) and then delete them.
  9. Click OK.
  10. Select Use the following DNS server addresses. If there are IP addresses listed in the Preferred DNS server or Alternate DNS server save them for future and replace them with the IP addresses of CZ.NIC resolvers:
    • 193.17.47.1, 185.43.135.1
  11. Click OK.
  12. Select Internet Protocol Version 6 (TCP/IPv6) and click on Properties. Follow the same steps as in points 8 to 10. Use the following IP addresses:
    • 2001:148f:ffff::1, 2001:148f:fffe::1
  13. Click OK.
  14. Click OK again.
  15. Repeat steps from point 5 for all connections for which you want to use CZ.NIC resolvers.

mac OS

  1. From the Apple menu (apple symbol) select System Preferences, then click Network.
  2. If the lock icon in the lower left corner is locked, click on it to authorize changes. You will need to enter your password.
  3. Select a network connection for which you want to set CZ.NIC resolvers and click Advanced.
  4. Select the DNS tab.
  5. If IP addresses are listed, save them for future in case you want to stop using CZ.NIC resolvers.
  6. Click the + button and replace current IP addresses with IP addresses of CZ.NIC resolvers:
    • IPv4 addresses: 193.17.47.1, 185.43.135.1
    • IPv6 addresses: 2001:148f:ffff::1, 2001:148f:fffe::1
  7. Click the OK button and then Apply.
  8. Test whether CZ.NIC resolvers are working correctly – see test below.
  9. Repeat the previous steps for all network settings for which you wish to use CZ.NIC Open DNSSEC Validating Resolvers.

Linux (Ubuntu 24 LTS)

If your Linux distribution does not use Network Manager, consult your distribution's documentation or vendor for instructions on changing DNS resolvers.

  1. Start Advanced Network Configuration (alternatively Network Manager).
  2. Select a network connection for which you want to set CZ.NIC resolvers.
    • For wired connection, select a connection you use in the Ethernet section (e.g. Wired connection 1).
    • For wireless connection, select a connection you use in the Wi-Fi section.
  3. Click Edit the selected connection (cog symbol).
  4. IPv4 Settings tab:
    • Method: Automatic (DHCP) addresses only. If you have already set Automatic (DHCP) addresses only and the DNS servers field contains IP addresses, make a note of them in case you want to stop using CZ.NIC resolvers in the future.
    • DNS servers: 193.17.47.1, 185.43.135.1 (use commas to separate multiple addresses)
  5. IPv6 Settings tab:
    • Method: Automatic, addresses only. If you have already set Automatic, addresses only and the DNS servers field contains IP addresses, make a note of them in case you want to stop using CZ.NIC resolvers in the future.
    • DNS servers: 2001:148f:ffff::1, 2001:148f:fffe::1 (use commas to separate multiple addresses).
  6. Click the Save button (depending on your system, you may need to enter your password to make changes.) and close the window.
  7. Test whether CZ.NIC resolvers are working correctly – see test below.
  8. Repeat the previous steps for all network settings for which you wish to use CZ.NIC Open DNSSEC Validating Resolvers.

How to turn on DNS-over-TLS (DoT)

The DoT protocol protects communication between client and DNS resolver by means of TLS encryption and listens on port TCP/853. To set DoT, you can use for example the stub resolver Stubby. There are installation packages for Linux, Windows and macOS.

  1. First, you need to configure Stubby. You can do it in file /etc/stubby/stubby.yml on Linux or C:Program FilesStubbystubby.xml on MS Windows.

  2. Insert configuration 

    resolution_type: GETDNS_RESOLUTION_STUB

dnssec_return_status: GETDNS_EXTENSION_TRUE

dns_transport_list:
  - GETDNS_TRANSPORT_TLS

tls_authentication: GETDNS_AUTHENTICATION_REQUIRED

tls_query_padding_blocksize: 128

edns_client_subnet_private : 1

idle_timeout: 10000

listen_addresses:
  - 127.0.0.1
  -  0::1

round_robin_upstreams: 1

upstream_recursive_servers:
#IPv4 ODVR
   - address_data: 193.17.47.1
     tls_auth_name: "odvr.nic.cz"
   - address_data: 185.43.135.1
     tls_auth_name: "odvr.nic.cz"
#IPv6 ODVR
   - address_data: 2001:148f:ffff::1
     tls_auth_name: "odvr.nic.cz"
   - address_data: 2001:148f:fffe::1
     tls_auth_name: "odvr.nic.cz"

  3. Start the stubby service

  4. On Linux via systemd - "systemctl start stubby“

  5. On MS Windows so far manually from the command line - "C:Program FilesStubbystubby.exe -l“ (IT developers promise to run it as a service in the future).

  6. Finally, you need to change DNS resolvers in the network setting to "127.0.0.1“ or "::1“. See the previous chapters for details.

You can then verify that you are communicating with ODVR in a secure way, by means of the tcpdump tool on Linux or wireshark on Windows with an active filter "host odvr.nic.cz and port 853“

How to turn on DNS-over-HTTPS (DoH)

The DoH protocol, the same as DoT, protects communication between client and DNS resolver by means of TLS encryption, but in this case on port TCP/443. Another difference is that it is used directly in the web browser and there is no need to install and configure additional services.

Firefox settings:

  1. Go to Settings (three horizontal lines in the bar in the top right corner).
  2. Select Privacy and security.
  3. Go to the DNS over HTTPS section.
  4. Select Max Protection.
  5. Choose Custom provider and set it as: https://odvr.nic.cz/

Chrome settings:

  1. Go to Settings (three vertical dots in the bar in the top right corner).
  2. Select Privacy and security.
  3. Select Security.
  4. Go to Advanced.
  5. Enable Use secure DNS option.
  6. Select CZ.NIC ODVR as your DNS provider.
ODVR Chrome with DoH

A shortcut to this setting is entering chrome://settings/security in the browser‘s address bar.

You can then verify whether you are actually communicating with ODVR in a secured way using the tcpdump tool on Linux or the wireshark tool on Windows with active filter "host odvr.nic.cz and port 443“.

DNS-over-HTTPS supports only the HTTP/2 protocol.

Have I set up ODVR correctly?

You can verify the correctness of your setting via the test bellow.

What benefits do I get from using CZ.NIC resolvers?

Most Internet service providers (and DNS resolvers) do not support DNS validation on their servers. Using CZ.NIC ODVR ensures that your DNS queries are validated with the DNSSEC technology.

Will all my DNS queries be secured if I use CZ.NIC resolvers?

No. There are two reasons why only some DNS queries would be secured:

  1. Most domain names are not yet signed with the DNSSEC technology. Validation (i.e. security check) is possible only for signed domain names.
  2. Most applications, e.g. a web browser or a stub resolver (operating system component responsible for the communication with DNS) in your computer does not support the DNSSEC technology. That means that unless you use a specialized application, such as DNSSEC Validator aadd-on for the Firefox browser, you will not know whether a given page is secured or not.

Is using CZ.NIC resolvers safe?

That depends on many factors. There is a theoretical possibility that an adversary could attack the connection between your computer and CZ.NIC resolvers in case your stub resolver did not use well randomized ports for communication with the CZ.NIC resolvers.

How is my personal information secured?

CZ.NIC temporarily processes IP addresses of devices you are using and never stores it in permanent logs. CZ.NIC stores these IP addresses only temporarily for a few minutes and then CZ.NIC deletes it permanently. CZ.NIC stores traffic captures with anonymized IP addresses. This allows CZ.NIC to improve ODVR operation and to do DNS research.

The content of the traffic captures includes, for example:
- absolute packet arrival time
- transport protocol headers from transport used to deliver the request (UDP, TCP, TLS, HTTPS etc.)
- requested domain name, e.g., www.nic.cz
- requested record type, e.g., A, AAAA, NS, MX, TXT, etc.
- DNS protocol flags and bits, e.g., Checking Disabled bit, EDNS options, etc.
- Full response sent to the client, e.g., SUCCESS, SERVFAIL, NXDOMAIN, IP addresses for the requested domain name (e.g., IP address of www.nic.cz) etc.
- total time taken to process the request end-to-end

The processing of personal data for this service is governed by the applicable Privacy Policy.

But open DNS resolvers are evil, are they not?

Open DNS resolvers that are not tightly monitored by their administrators might be abused for distributed DoS attacks. CZ.NIC's Open DNSSEC Validating Resolvers are configured such that it is difficult to misuse them for DDoS against third-party servers. Additionally, the servers are monitored and security mechanisms will alert in case of any unusual activity that is then analysed and countermeasures taken if needed.

Resolver usage test

Note: Due to the character of the test, it can take up to tens of seconds to finish.

Running the test repeatedly can return the same results despite making changes in the settings of the router or the system (due to the browser‘s or system‘s DNS cache). Therefore, you should try to run the test using another browser or after some time.