# Bezmezhau DNS — Full Documentation & Technical Specification

> Free encrypted DNS resolver and SmartDNS service for Belarus. Bezmezhau enables seamless access to geo-restricted services without routing all traffic through a slow VPN, blocks ads and trackers at the DNS level, and provides encrypted DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH).

---

## 1. Overview & Core Philosophy

**Bezmezhau DNS** (https://bezmezhau.com/) is an open, privacy-oriented DNS resolver and SmartDNS infrastructure designed specifically for internet users in Belarus.

### Core Value Proposition
- **SmartDNS, Not a VPN:** Unlike a full-tunnel VPN that encrypts and routes 100% of your internet traffic through a remote server (which increases latency, consumes extra battery, and slows down video streams and file downloads), Bezmezhau DNS only intervenes at the domain name resolution level and routes TLS handshakes for specific geo-blocked services.
- **Zero Speed Loss for Native Traffic:** All normal internet traffic (local websites, banking, domestic streaming, gaming, messaging) connects directly to destination servers at full native ISP wire speed with zero proxy overhead.
- **DNS-Level Ad & Tracker Blocking:** Malicious domains, tracking scripts, telemetry, and advertising networks are sinkholed directly at the resolver level (returning `0.0.0.0`), saving mobile data and boosting browsing speed.
- **Strict Privacy & Zero Logging:** User DNS resolution histories and personal browsing activities are never recorded, logged, or monetized.
- **No Client Software or Registration Required:** Setup takes less than 60 seconds using standard native operating system settings without installing proprietary client applications or creating accounts.

---

## 2. Architecture & Technical Implementation

The platform operates as a distributed, high-availability multi-tier infrastructure:

### 2.1. Traffic Flow & Dual-Tier Resolution
1. **DNS Query Layer:**
   - Inbound DNS queries are handled by **AdGuard Home** listening on standard UDP/TCP port `53`, DoT port `853`, and internal DoH listener `127.0.0.1:3443`.
   - AdGuard Home checks incoming domains against threat lists, ad-block filters, and custom SmartDNS rewrite rules.
   - For standard internet domains, queries are forwarded to a local recursive caching resolver (**Unbound** on `127.0.0.1:53`), providing fast, independent upstream recursion directly from root DNS and TLD authorities with DNSSEC validation.
2. **SmartDNS Geo-Bypass Mechanism:**
   - Specific geo-restricted services (e.g., ChatGPT, Claude, Spotify, Netflix, JetBrains) have custom rewrite rules configured in AdGuard Home.
   - Instead of returning the external IP address directly, the resolver returns the IP of the Bezmezhau SmartDNS edge proxy.
3. **SNI Routing & TLS Passthrough:**
   - The edge server runs an SNI-aware routing engine (**Xray** on port `443` combined with a local SNI proxy on `127.0.0.1:9443`).
   - The proxy reads the Server Name Indication (SNI) from the initial TLS client handshake and proxies the raw TCP/TLS connection directly to the target service's real IP in Western Europe.
   - **Crucial Security Note:** The proxy does NOT terminate or decrypt the TLS connection. The end-to-end cryptographic encryption between the user's browser/app and the target service remains 100% intact. No custom Root CA certificates are needed, and no intermediate inspection occurs.

### 2.2. Failover Architecture
- **Primary Node (Germany):** IPv4 `181.215.40.49` — handles primary traffic, main Next.js web portal, DoH/DoT endpoints, and SmartDNS proxying.
- **Secondary Node (Netherlands):** IPv4 `31.58.216.201` — handles Prometheus monitoring, automated health probing, offsite encrypted backups, and serves as an active hot standby DNS/SmartDNS proxy.
- **Automated Cloudflare DNS Failover:** A health-check daemon runs every 60 seconds on the secondary node. If the primary node experiences network degradation, UDP/TCP DNS timeout, or DoH/DoT failure, Cloudflare DNS records for `dns.bezmezhau.com` are automatically updated to point to the backup node within seconds.

---

## 3. Network Endpoints & Profiles

| Protocol | Address / Hostname | Port | Recommended Usage |
|---|---|---|---|
| **Plain DNS (Primary)** | `181.215.40.49` | `53` (UDP/TCP) | Routers, Windows, Smart TVs, game consoles |
| **Plain DNS (Secondary)** | `31.58.216.201` | `53` (UDP/TCP) | Backup IPv4 DNS in OS and router network settings |
| **DNS-over-TLS (DoT)** | `dns.bezmezhau.com` | `853` (TCP) | Android 9+ Private DNS, Keenetic/OpenWrt routers, Apple DoT |
| **DNS-over-HTTPS (DoH)** | `https://dns.bezmezhau.com/dns-query` | `443` (HTTPS) | Web browsers, MikroTik, Linux, iOS/macOS, Windows 11 DoH |
| **Apple MobileConfig (DoT)** | `https://dns.bezmezhau.com/bezmezhau-dns.mobileconfig` | N/A | One-click profile for iPhone, iPad, macOS (native DoT) |
| **Apple MobileConfig (DoH)** | `https://dns.bezmezhau.com/bezmezhau-dns-doh.mobileconfig` | N/A | One-click profile for Apple devices when port 853 is blocked |

---

## 4. Step-by-Step Setup Guides by Platform

### 4.1. Android (Android 9.0+) — Native Private DNS (Recommended)
Android includes built-in DNS-over-TLS encryption at the system level:
1. Open **Settings** on your Android device.
2. Navigate to **Network & internet** (or **Connections**).
3. Tap **Private DNS** (on Samsung devices: *Settings → Connections → More connection settings → Private DNS*).
4. Select **Private DNS provider hostname**.
5. Enter: `dns.bezmezhau.com`
6. Tap **Save**.
7. Test your setup at https://bezmezhau.com/setup in the **DNS Check** section.

### 4.2. Apple iOS & iPadOS (iPhone / iPad)
Apple devices support native system-wide encrypted DNS via signed mobileconfig profiles:
1. Open Safari on your iPhone or iPad and navigate to https://bezmezhau.com/setup.
2. Tap **Download iOS Profile** (or directly download `https://dns.bezmezhau.com/bezmezhau-dns.mobileconfig`).
   *Note: If your mobile carrier or Wi-Fi restricts port 853, download the DoH profile instead (`bezmezhau-dns-doh.mobileconfig`).*
3. Allow the configuration profile download when prompted.
4. Open **Settings → Profile Downloaded** (or **Settings → General → VPN & Device Management**).
5. Select **Bezmezhau Smart DNS** and tap **Install** (enter device passcode when asked).
6. Ensure only one DNS profile is active at a time.
7. Restart Safari and verify connection at https://bezmezhau.com/setup.

### 4.3. Windows 10 & Windows 11
#### Standard IPv4 Configuration:
1. Open **Settings** (`Win + I`) → **Network & internet**.
2. Select your active connection (**Wi-Fi** or **Ethernet**).
3. Under **DNS server assignment**, click **Edit**.
4. Select **Manual** and enable **IPv4**.
5. Set:
   - **Preferred DNS:** `181.215.40.49`
   - **Alternate DNS:** `31.58.216.201`
6. Click **Save**.
7. Flush local DNS cache: Open Command Prompt or PowerShell and execute:
   ```cmd
   ipconfig /flushdns
   ```

> [!IMPORTANT]
> **Do not set public DNS (such as 1.1.1.1, 8.8.8.8, or ISP DNS) as the Alternate DNS.** Windows queries both DNS servers concurrently or fails over randomly; if a foreign DNS answers, bypass rules will fail. Always use `181.215.40.49` as primary and `31.58.216.201` as secondary.

### 4.4. macOS (MacBook, iMac, Mac mini)
#### Option A: Profile Installation (Encrypted DoT/DoH)
Download and double-click `https://dns.bezmezhau.com/bezmezhau-dns.mobileconfig`. Open **System Settings → Privacy & Security → Profiles**, select the profile, and click **Install**.

#### Option B: Manual Network DNS
1. Open **System Settings → Network**.
2. Select active **Wi-Fi** or **Ethernet** → Click **Details...**
3. Select the **DNS** tab on the left.
4. Click `+` under DNS Servers and add:
   - `181.215.40.49`
   - `31.58.216.201`
5. Remove any other DNS entries from the list.
6. Click **OK** and apply changes.

### 4.5. Home & Office Routers
Configuring DNS on your router protects every device connected to your local network (including Smart TVs, consoles, and IoT devices) with zero per-device configuration.

#### Standard IPv4 Router Configuration:
1. Log in to your router admin panel (typically `192.168.1.1`, `192.168.0.1`, or `192.168.31.1`).
2. Go to **Internet**, **WAN**, **DHCP**, or **DNS** settings.
3. Replace ISP DNS servers with:
   - **Primary DNS:** `181.215.40.49`
   - **Secondary DNS:** `31.58.216.201`
4. Save settings and reboot your router (or reconnect client devices to renew DHCP leases).

#### Keenetic Routers (Native DoT / DoH):
1. In Keenetic Web UI, navigate to **Network Rules → Internet Safety**.
2. Click **Add server** under DNS Configuration.
3. Protocol: **DNS-over-TLS (DoT)**
   - Server Address: `dns.bezmezhau.com`
   - TLS Hostname (SNI): `dns.bezmezhau.com`
   - Port: `853`
4. Save and apply to the default home segment.

#### OpenWrt (dnsmasq / https-dns-proxy):
Configure `/etc/config/dhcp` to advertise custom DNS or install `https-dns-proxy`:
```uci
set https-dns-proxy.bezmezhau=https-dns-proxy
set https-dns-proxy.bezmezhau.bootstrap_dns='181.215.40.49'
set https-dns-proxy.bezmezhau.resolver_url='https://dns.bezmezhau.com/dns-query'
set https-dns-proxy.bezmezhau.listen_addr='127.0.0.1'
set https-dns-proxy.bezmezhau.listen_port='5053'
commit https-dns-proxy
/etc/init.d/https-dns-proxy restart
```

#### MikroTik RouterOS:
In WinBox or Terminal:
```routeros
/ip dns set servers=181.215.40.49,31.58.216.201 allow-remote-requests=yes
# Or using native DoH:
/ip dns set use-doh-server="https://dns.bezmezhau.com/dns-query" verify-doh-cert=yes
```

### 4.6. Smart TV & Streaming Devices
- **Android TV / Google TV:** Settings → Network & Internet → Network Settings → IP Settings → Static → Set DNS 1 to `181.215.40.49` and DNS 2 to `31.58.216.201`.
- **Apple TV:** Settings → Network → Wi-Fi/Ethernet → Configure DNS → Manual → Enter `181.215.40.49`.
- **Samsung Tizen / LG webOS:** Network Settings → IP Settings → DNS Manual → `181.215.40.49`.
*(Tip: Setting DNS directly on your home router is simpler and more reliable for Smart TVs).*

### 4.7. Web Browsers (DoH Configuration)
If you cannot modify system or router settings, you can configure DNS-over-HTTPS directly in your browser:
- **Google Chrome / Brave / Edge:** Settings → Privacy and security → Security → Enable "Use secure DNS" → Choose "Custom" → Paste: `https://dns.bezmezhau.com/dns-query`.
- **Mozilla Firefox:** Settings → Privacy & Security → DNS over HTTPS → Choose "Max Protection" or "Increased Protection" → Choose "Custom" → Paste: `https://dns.bezmezhau.com/dns-query`.

---

## 5. Supported Services & Geo-Unblocking Capabilities

Bezmezhau DNS enables seamless access to major international platforms that restrict or block IP addresses originating from Belarus:

- **AI Assistants & Developer Tools:**
  - OpenAI (ChatGPT, ChatGPT Plus, OpenAI API, platform.openai.com)
  - Anthropic Claude (claude.ai, API)
  - Perplexity AI
  - Google Gemini / Google AI Studio
  - Midjourney (Discord web app & app interactions)
  - JetBrains Account & licensing services
  - Canva
  - Notion AI
- **Streaming & Entertainment:**
  - Spotify (audio streaming, login, recommendations, web player)
  - Netflix (catalog browsing, user profiles, streaming playback)
- **News, Information & Global Cloud Infrastructure:**
  - Selected international news outlets and platforms restricted by domestic or foreign geographic policy.

*The service whitelist is continuously updated and managed to maintain fast resolution and bypass reliability.*

---

## 6. Ad & Tracker Filtering Engine

Every DNS request processed by Bezmezhau DNS passes through a high-throughput filtering engine:
1. **Ad Networks:** Google DoubleClick, AdSense, Yandex Direct banner domains, telemetry aggregators, and in-app interstitial ad hosts are sinkholed to `0.0.0.0`.
2. **Behavioral Trackers & Telemetry:** Mobile app telemetry (crashlytics, ad-tracking IDs, analytics beacons) is blocked at the network level before connections are established.
3. **Phishing & Malware:** Known malicious domains, malware distribution centers, and command-and-control (C2) hosts are blacklisted based on aggregated cybersecurity threat feeds.
4. **Performance Benefit:** Because ad scripts and tracking pixels never download, web pages load up to 30–50% faster, and mobile battery and data usage are significantly reduced.

---

## 7. Diagnostics & Connection Verification

### 7.1. Web Diagnostic Tool
Visit **https://bezmezhau.com/setup#dns-check**.
The built-in diagnostic tool generates a unique, non-cacheable random query string under `*.check.bezmezhau.com`. If the check server receives the query through Bezmezhau's resolvers, the badge turns green (**"Bezmezhau DNS Active"**) and reports your current protocol (DoT, DoH, or Plain DNS).

### 7.2. Command-Line Verification
Run these commands in your terminal to test resolution and filtering:

1. **Verify Ad-Blocking:**
   ```bash
   # Should resolve to 0.0.0.0
   nslookup doubleclick.net 181.215.40.49
   ```
2. **Verify SmartDNS Rewrite:**
   ```bash
   # Should resolve to Bezmezhau edge proxy IP 181.215.40.49
   nslookup chatgpt.com 181.215.40.49
   ```
3. **Verify Normal Internet Resolution:**
   ```bash
   # Should resolve to standard public Google IPs
   nslookup google.com 181.215.40.49
   ```
4. **Test DoH Endpoint directly:**
   ```bash
   curl -i "https://dns.bezmezhau.com/dns-query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB"
   ```

---

## 8. High Availability & Cloudflare Failover

To guarantee 99.9% uptime and zero downtime during maintenance:
- Two redundant physical data centers (Frankfurt, Germany & Amsterdam, Netherlands) operate synchronized instances of AdGuard Home, Unbound, and SNI Proxy.
- An autonomous daemon (`cloudflare_dns_failover.py`) continuously verifies:
  - UDP port 53 DNS responses
  - TCP port 53 DNS responses
  - DoH HTTPS endpoint response code 200 and MIME type `application/dns-message`
  - DoT TLS handshake and certificate chain validity on port 853
- In the event of primary hardware failure, the system automatically redirects DNS routing to the backup node via Cloudflare API.

---

## 9. Frequently Asked Questions (FAQ)

### Q: Is using Bezmezhau DNS legal?
**A:** Yes. Configuring a custom DNS server is a standard network setting built into every modern operating system, smartphone, and router. You have the right to choose which DNS resolver your device uses for domain resolution.

### Q: How does SmartDNS differ from a traditional VPN?
**A:** A traditional VPN routes all network traffic (every video stream, downloaded file, or banking session) through a remote encrypted tunnel. This often leads to high latency, slower internet speeds, battery drain, and issues with local domestic services (such as banking apps that block foreign IPs). Bezmezhau SmartDNS only touches domain resolution and routes traffic for selected blocked domains. Your regular traffic never goes through our servers.

### Q: Does Bezmezhau decrypt or inspect my HTTPS traffic?
**A:** Absolutely not. The SNI proxy routes encrypted TLS packets purely by reading the unencrypted domain name from the TLS ClientHello header. It does not possess, generate, or require SSL/TLS certificates for the target services. All traffic between your device and services like ChatGPT or Spotify is end-to-end encrypted with the target's authentic certificates.

### Q: Is the service free? Are there paid tiers or subscriptions?
**A:** The core DNS service is completely free with no registration, no subscription fees, and no artificial bandwidth throttling.

### Q: Will local Belarusian and Russian services continue to work?
**A:** Yes. Because local domains are not included in the bypass list, they resolve directly to their real IP addresses, and your connection to them goes straight through your local ISP with zero latency change.

---

## 10. Privacy Policy & Data Processing

- **No Logging of DNS Query Histories:** We do not record, store, or profile the domains or IP addresses visited by individual users.
- **Ephemeral Diagnostics Only:** Server logs retain only minimal, aggregated diagnostic data (connection volume, error codes, high-level DDoS mitigation statistics) strictly necessary to guarantee uptime and security.
- **No Third-Party Sharing or Data Monetization:** We do not sell, share, or monetize any telemetry, request metadata, or user details.
- **Encrypted In-Flight Communication:** When using DoT or DoH, DNS queries between your device and Bezmezhau resolvers are strongly encrypted, preventing local network eavesdropping or ISP snooping.

---

## 11. Terms of Service & Acceptable Use

By using Bezmezhau DNS, you agree to the following terms:
1. The service is provided on an "as is" and "as available" basis without warranties of any kind.
2. The infrastructure must not be used for malicious purposes, distributed denial-of-service (DDoS) attacks, network abuse, automated port scanning, credential stuffing, or exploitation of third-party infrastructure.
3. Users are responsible for their own compliance with the terms of service of third-party platforms accessed via the resolver.
4. We reserve the right to rate-limit or block abusive IP addresses that endanger the stability, availability, or security of the service.

---

## 12. Contacts & Community Support

- **Official Website:** https://bezmezhau.com/
- **Setup Guide & Verification Tool:** https://bezmezhau.com/setup
- **Telegram Channel & Support:** https://t.me/bezmezhau
- **Abuse & Security Incident Reports:** Contact via the official Telegram channel or submit technical details (UTC timestamp, destination IP/domain, incident description) directly to the maintainers.