From other threads…
Fm Normis
Follow these steps exactly:
./ip dns set servers=1.1.1.1,1.0.0.1
./system ntp client set enabled=yes server-dns-names=time.cloudflare.com
./tool fetch url=https://curl.haxx.se/ca/cacert.pem
./certificate import file-name=cacert.pem passphrase=“”
./ip dns set use-doh-server=https://1.1.1.1/dns-query verify-doh-cert=yes
./ip dns set servers=“”
ALso…
https://jcutrer.com/howto/networking/mikrotik/mikrotik-dns-over-https
why do i need a root certificate?
Because it is not included in RouterOS.
I did not use any certificate, just added:
/ip dns
set allow-remote-requests=yes use-doh-server=https://1.1.1.1/dns-query
One line only for DNS and it works fine.
With that setup you might as well just omit the DoH and use 1.1.1.1 DNS directly…
Why?
Do you thing my ISP opens up the https packets and look for DNS packets?
I will add certificate later. This was just for testing purpose, since DoH was just released.
Because a trusted channel is completely useless when you don’t validate who is at the other end…
Do you thing my ISP opens up the https packets and look for DNS packets?
No, but neither do I think that my ISP will fiddle with DNS traffic towards 1.1.1.1 (inspecting or modifying it).
So I have not configured DoH.
(even more so because now finally the DNS resolver improvements I have been asking for have been implemented, and they are mutually incompatible with DoH due to a design error at MikroTik)
I will add certificate later. This was just for testing purpose, since DoH was just released.
Setting a working DoH (that will also work after reboot) is still a bit tricky with this version.
Hi Pe1chl, (so hard just change ur nick to Pikachu 
Please let me know when the MT router is actually ready for doh dns. (without errors in logs for example).
I wish to use it and point all my devices to it.
Assuming that I will still need action redirect chain=dstnat rules to ensure people dont go around lease settings??
He simply doesn’t understand us HAMS. 
DE W0LT 73’s
-tp
Just want to share to all people, if you want to verify the DoH server, you can go to https://1.1.1.1/dns-query using the web browser and download the the 3 certificates from the server site. Then import the 3 certificates to your router and it should be fine.
The guide link is using the Mozilla CA which i not necessary to use them all, i just need the DoH server site certificates.
Hope it help you >.<
There are no webpage opening at this url.
yes correct there is no page, but you can view the site certificate from the browser pad lock and download the 3 certificates from there.
Only two certificates are required, use the two with “DigiCert” in name. The “cloudflare-dns.com” certificate is shipped by the server.
Are you sure it needs the intermediate certificate as well? It works for me with just the root certificate as well. I have published the example on wiki as well if you have any comments:
That depends how the server is configured. It should return the intermediate certificate in the reply, but some servers do not do that.
I completed everything that is written in the instructions, I get an error:
DoH server connection error: Connection refused
W0lt are you a true ham or one of these quasi fake HAMS that uses internet repeaters LOL.
Whats the point of that!!! When the internet goes down, the we see the true HAMS… 
PS. Oh yes back to the topic.
Sounds like between Doh error messages and excessive writes to the router, might be best to wait to next patch.
I think one thing is unclear here. While my DoH setup is working flawlessly I wonder what’s the decision tree for DoH vs UDP. If I have DoH + normal DNS configured which one is used? Is there a fallback if DoH is inaccessible?
Personally, since it’s uncertain, I removed the normal DNS and set CF DoH only.
I did comment this as well in the 6.47 thread. There are no way to see if the router uses DoH server or the DNS, so the solution for me was to not use DNS name like this: https://1.1.1.1/dns-query instead of this https://cloudflare-dns.com/dns-query. And no static DNS added. So only DoH that respond to DNS request.
Edit
Did a test and added a DNS server 8.8.8.8, then change DoH to https://1.1.1.250/dns-query (non working IP)
Logg filled quickly up with message like this:
DoH server connection error: SSL: handshake failed: error 14077410 (6)
The Router did not fall back to old DNS, so if DoH is configured and does not work, it stops resolve DNS requests, even if a DNS is configured.
Maybe I can make a script that test if DoH resolve DNS and if not disable it. But not sure how to make it go back to DoH. On solution is to set DoH at start of script, do a test if it works, if yes let it stay with DoH, if not remove DoH and use the DNS server until next time script runs.
Take the code below as an inspiration - you can run the check every now and then whenever the DoH server is disabled, and instead of put “success”, re-enable the DoH in DNS configuration. Please don’t ask me why the value returned by /tool fetch output=file in case of success is a semicolon and whether it will still be the case in next ROS versions.
[me@MyTik] > :if ([:do {tool fetch url=“https://1.1.1.1/dns-query?name=mikrotik.com%26type=A” output=file dst-path=result http-header-field=accept:application/dns-json} on-error={put “failure”}] = “;”) do={put “success”}