DNS config not functioning properly

bloodynetworker · October 18, 2026, 1:14pm

Below you can see my entire export script. Pinging IP Addresses works, but resolving DNS does not. I don't see what I'm doing wrong, please help

/interface bridge
add comment=genconf name=bridge protocol-mode=mstp vlan-filtering=yes
/interface ethernet
set [ find default-name=sfp1 ] disabled=yes
/interface vlan
add comment=management interface=bridge name=ADMIN vlan-id=10
add interface=bridge name=APP vlan-id=40
add interface=bridge name=FAMILY vlan-id=20
add interface=bridge name=GUEST vlan-id=50
add interface=bridge name=JAIL vlan-id=60
add interface=bridge name=VPN vlan-id=30
/interface list
add comment=genconf name=WAN
add comment=genconf name=LAN
/interface wifi channel
add band=2ghz-ax name=ch-2ghz width=20mhz
add band=5ghz-ax name=ch-5ghz skip-dfs-channels=10min-cac width=20/40/80mhz
/interface wifi datapath
add bridge=bridge name=dp-vlan20 vlan-id=20
add bridge=bridge client-isolation=yes name=dp-vlan50-iso vlan-id=50
add bridge=bridge client-isolation=yes name=dp-vlan60-iso vlan-id=60
/interface wifi security
add authentication-types=wpa3-psk disable-pmkid=yes disabled=no ft=yes ft-over-ds=yes name=sec-home-34-family wps=disable
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=yes ft-over-ds=yes name=sec-home-34-guest wps=push-button
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=yes ft-over-ds=yes name=sec-home-34-jail wps=push-button
/interface wifi configuration
add channel=ch-2ghz country=Germany datapath=dp-vlan20 mode=ap name=cfg-home-34-family-24ghz security=sec-home-34-family ssid=\
    home.34.FAMILY
add channel=ch-5ghz country=Germany datapath=dp-vlan20 mode=ap name=cfg-home-34-family-5ghz security=sec-home-34-family ssid=\
    home.34.FAMILY
add channel=ch-2ghz country=Germany datapath=dp-vlan50-iso mode=ap name=cfg-home-34-guest-24ghz security=sec-home-34-guest ssid=\
    home.34.GUEST
add channel=ch-5ghz country=Germany datapath=dp-vlan50-iso mode=ap name=cfg-home-34-guest-5ghz security=sec-home-34-guest ssid=\
    home.34.GUEST
add channel=ch-2ghz country=Germany datapath=dp-vlan60-iso mode=ap name=cfg-home-34-jail-24ghz security=sec-home-34-jail ssid=\
    home.34.JAIL
add channel=ch-5ghz country=Germany datapath=dp-vlan60-iso mode=ap name=cfg-home-34-jail-5ghz security=sec-home-34-jail ssid=\
    home.34.JAIL
/ip pool
add name=pool-ADMIN ranges=10.0.10.10-10.0.10.254
add name=pool-FAMILY ranges=10.0.20.10-10.0.20.254
add name=pool-VPN ranges=10.0.30.10-10.0.30.254
add name=pool-APP ranges=10.0.40.10-10.0.40.254
add name=pool-GUEST ranges=10.0.50.10-10.0.50.254
add name=pool-JAIL ranges=10.0.60.10-10.0.60.254
/ip dhcp-server
add address-pool=pool-ADMIN interface=ADMIN lease-time=1d name=dhcp-ADMIN
add address-pool=pool-FAMILY interface=FAMILY lease-time=1d name=dhcp-FAMILY
add address-pool=pool-VPN interface=VPN lease-time=1d name=dhcp-VPN
add address-pool=pool-APP interface=APP lease-time=1d name=dhcp-APP
add address-pool=pool-GUEST interface=GUEST lease-time=1d name=dhcp-GUEST
add address-pool=pool-JAIL interface=JAIL lease-time=1d name=dhcp-JAIL
/certificate settings
set builtin-trust-store=all
/interface bridge filter
add action=drop chain=forward comment="genconf: IPv6 off, bridged frames the CPU forwards" mac-protocol=ipv6
add action=drop chain=input comment="genconf: IPv6 off, frames to the router" mac-protocol=ipv6
/interface bridge port
add bridge=bridge comment=genconf frame-types=admit-only-vlan-tagged interface=ether2
add bridge=bridge comment=genconf frame-types=admit-only-vlan-tagged interface=ether3
add bridge=bridge comment=genconf frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=10
add bridge=bridge comment=genconf frame-types=admit-only-untagged-and-priority-tagged interface=ether5 pvid=50
add bridge=bridge comment=genconf frame-types=admit-only-untagged-and-priority-tagged interface=sfp1 pvid=10
/ip firewall connection tracking
set tcp-established-timeout=1h
/ip neighbor discovery-settings
set discover-interface-list=LAN
/ipv6 settings
set accept-redirects=no accept-router-advertisements=no disable-ipv6=yes forward=no
/interface bridge vlan
add bridge=bridge comment="ADMIN and SFP" tagged=bridge untagged=ether4,sfp1 vlan-ids=10
add bridge=bridge comment=FAMILY tagged=bridge,ether3 vlan-ids=20
add bridge=bridge comment=VPN tagged=bridge vlan-ids=30
add bridge=bridge comment=APP tagged=bridge,ether2 vlan-ids=40
add bridge=bridge comment=GUEST tagged=bridge,ether3 untagged=ether5 vlan-ids=50
add bridge=bridge comment=JAIL tagged=bridge,ether3 vlan-ids=60
/interface list member
add comment=genconf interface=ether1 list=WAN
add comment=genconf interface=bridge list=LAN
add comment=genconf interface=ADMIN list=LAN
add comment=genconf interface=FAMILY list=LAN
add comment=genconf interface=VPN list=LAN
add comment=genconf interface=APP list=LAN
add comment=genconf interface=GUEST list=LAN
add comment=genconf interface=JAIL list=LAN
/interface wifi cap
set caps-man-addresses=127.0.0.1 certificate=request enabled=yes slaves-static=no
/interface wifi capsman
set enabled=yes interfaces=bridge require-peer-certificate=yes upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-dynamic-enabled comment=2.4ghz master-configuration=cfg-home-34-family-24ghz name-format=cap-%I-24ghz \
    slave-configurations=cfg-home-34-guest-24ghz,cfg-home-34-jail-24ghz supported-bands=2ghz-ax,2ghz-n,2ghz-g
add action=create-dynamic-enabled comment=5ghz master-configuration=cfg-home-34-family-5ghz name-format=cap-%I-5ghz \
    slave-configurations=cfg-home-34-guest-5ghz,cfg-home-34-jail-5ghz supported-bands=5ghz-ax,5ghz-ac,5ghz-n
/ip address
add address=10.0.10.1/24 comment=ADMIN interface=ADMIN network=10.0.10.0
add address=10.0.20.1/24 comment=FAMILY interface=FAMILY network=10.0.20.0
add address=10.0.30.1/24 comment=VPN interface=VPN network=10.0.30.0
add address=10.0.40.1/24 comment=APP interface=APP network=10.0.40.0
add address=10.0.50.1/24 comment=GUEST interface=GUEST network=10.0.50.0
add address=10.0.60.1/24 comment=JAIL interface=JAIL network=10.0.60.0
add address=10.0.0.1/24 comment=genconf interface=bridge network=10.0.0.0
/ip dhcp-client
add comment=WAN1 interface=ether1 name=client1 use-peer-ntp=no
/ip dhcp-server network
add address=10.0.10.0/24 comment=ADMIN dns-server=10.0.10.1 gateway=10.0.10.1
add address=10.0.20.0/24 comment=FAMILY dns-server=10.0.20.1 gateway=10.0.20.1
add address=10.0.30.0/24 comment=VPN dns-server=10.0.30.1 gateway=10.0.30.1
add address=10.0.40.0/24 comment=APP dns-server=10.0.40.1 gateway=10.0.40.1
add address=10.0.50.0/24 comment=GUEST dns-server=10.0.50.1 gateway=10.0.50.1
add address=10.0.60.0/24 comment=JAIL dns-server=10.0.60.1 gateway=10.0.60.1
/ip dns
set allow-remote-requests=yes cache-size=4096KiB servers=9.9.9.9,149.112.112.112 use-doh-server=https://dns.quad9.net/dns-query \
    verify-doh-cert=yes
/ip dns adlist
add ssl-verify=no url=https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
/ip dns static
add address=9.9.9.9 comment="bootstrap DoH" name=dns.quad9.net type=A
add address=149.112.112.112 comment="bootstrap DoH" name=dns.quad9.net type=A
/ip firewall address-list
add address=127.0.0.0/8 comment="genconf: RFC6890" list=bad_ipv4
add address=192.0.0.0/24 comment="genconf: RFC6890" list=bad_ipv4
add address=192.0.2.0/24 comment="genconf: RFC6890 documentation" list=bad_ipv4
add address=198.51.100.0/24 comment="genconf: RFC6890 documentation" list=bad_ipv4
add address=203.0.113.0/24 comment="genconf: RFC6890 documentation" list=bad_ipv4
add address=240.0.0.0/4 comment="genconf: RFC6890 reserved" list=bad_ipv4
add address=0.0.0.0/8 comment="genconf: RFC6890" list=not_global_ipv4
add address=10.0.0.0/8 comment="genconf: RFC6890" list=not_global_ipv4
add address=100.64.0.0/10 comment="genconf: RFC6890" list=not_global_ipv4
add address=169.254.0.0/16 comment="genconf: RFC6890" list=not_global_ipv4
add address=172.16.0.0/12 comment="genconf: RFC6890" list=not_global_ipv4
add address=192.0.0.0/29 comment="genconf: RFC6890" list=not_global_ipv4
add address=192.168.0.0/16 comment="genconf: RFC6890" list=not_global_ipv4
add address=198.18.0.0/15 comment="genconf: RFC6890 benchmark" list=not_global_ipv4
add address=255.255.255.255 comment="genconf: RFC6890" list=not_global_ipv4
add address=224.0.0.0/4 comment="genconf: multicast" list=bad_src_ipv4
add address=255.255.255.255 comment="genconf: RFC6890" list=bad_src_ipv4
add address=0.0.0.0/8 comment="genconf: RFC6890" list=bad_dst_ipv4
add address=224.0.0.0/4 comment="genconf: RFC6890" list=bad_dst_ipv4
/ip firewall filter
add action=accept chain=input comment="genconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="genconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="genconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="genconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="drop DNS from WAN (no open resolver)" dst-port=53 in-interface-list=WAN protocol=udp
add action=drop chain=input comment="drop DNS from WAN (no open resolver)" dst-port=53 in-interface-list=WAN protocol=tcp
add action=accept chain=input comment="management from ADMIN" in-interface=ADMIN
add action=accept chain=input comment="LAN: DNS, DHCP, NTP to router" dst-port=53,67,123 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="LAN: DNS tcp to router" dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment="drop other LAN traffic to router (management VLAN only)" in-interface-list=LAN
add action=drop chain=input comment="genconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="genconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="genconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="genconf: fasttrack" connection-state=established,related
add action=accept chain=forward comment="genconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="genconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="isolate APP: internet only" connection-state=new in-interface=APP out-interface-list=!WAN
add action=drop chain=forward comment="isolate GUEST: internet only" connection-state=new in-interface=GUEST out-interface-list=!WAN
add action=drop chain=forward comment="isolate JAIL: internet only" connection-state=new in-interface=JAIL out-interface-list=!WAN
add action=drop chain=forward comment="JAIL: no internet" in-interface=JAIL out-interface-list=WAN
add action=drop chain=forward comment="genconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new \
    in-interface-list=WAN
/ip firewall nat
add action=redirect chain=dstnat comment="force LAN DNS through router" dst-address-type=!local dst-port=53 in-interface-list=LAN \
    protocol=udp to-ports=53
add action=redirect chain=dstnat comment="force LAN DNS through router" dst-address-type=!local dst-port=53 in-interface-list=LAN \
    protocol=tcp to-ports=53
add action=masquerade chain=srcnat comment="genconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ip firewall raw
add action=drop chain=prerouting comment="genconf: drop bogon IP's" src-address-list=bad_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" dst-address-list=bad_ipv4 in-interface-list=WAN
add action=drop chain=prerouting comment="genconf: drop bogon IP's" src-address-list=bad_src_ipv4
add action=drop chain=prerouting comment="genconf: drop bogon IP's" dst-address-list=bad_dst_ipv4 in-interface-list=WAN
add action=drop chain=prerouting comment="genconf: drop non global from WAN" in-interface-list=WAN src-address-list=not_global_ipv4
add action=drop chain=prerouting comment="genconf: drop bad UDP" port=0 protocol=udp
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set www disabled=yes
set winbox available-from=10.0.0.0/24,10.0.10.0/24
set api disabled=yes
set api-ssl disabled=yes
/ipv6 firewall filter
add action=drop chain=input comment="genconf: IPv6 off, drop everything to the router"
add action=drop chain=forward comment="genconf: IPv6 off, drop everything routed"
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Berlin
/system identity
set name=Main
/system ntp client
set enabled=yes
/system ntp client servers
add address=ptbtime1.ptb.de
add address=ptbtime2.ptb.de
add address=ptbtime3.ptb.de
/system routerboard settings
set auto-upgrade=yes
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=LAN
/tool mac-server ping
set enabled=no

drotz · October 18, 2026, 1:17pm

Try cloudflare instead, quad9 didnt work realiably for me either.

bloodynetworker · October 18, 2026, 1:18pm

I figured out something is wrong with my DoH config. I disabled it and now resolving :put [:resolve ``mikrotik.com``] works.

drotz · October 18, 2026, 1:19pm

Yup its an issue with quad9, i and a few other people have write-ups in the forums here about their DoH and mikrotik dns having issues with eachother.

bloodynetworker · October 18, 2026, 1:22pm

mhh youre right cloudflare DoH is working fine. weird and unfortunate issue I'd rather trust Quad9 my DNS queries than a big ol' merican corporation

drotz · October 18, 2026, 1:27pm

I literally say the same, but i like my internet to work lol, until mikrotik fixes their stuff and works better with HTTP/S 2 protocol and quad9 works realiably, im not touching it idc that much

bloodynetworker · October 18, 2026, 1:27pm

according to this post (i dont know whether any progress has been made to further increase support on other cpu platforms as well) only arm64 and x86 would "indirectly" support Quad9s DoH since they require min. HTTP2 and dropped support for HTTP1.1, which MikroTIk uses. Only arm64 and x86 use HTTP2, which explains why I have issues with Quad9 DoH with my hAP ax S since it uses arm32

bloodynetworker · October 18, 2026, 1:32pm

http3 would be even better ngl since it uses QUIC anyway and therefore ultimately gets rid of all the TCP metadata that TLS cannot encrypt

drotz · October 18, 2026, 1:35pm

Doesn't matter i have an rb5009upr and i still had "dns, memory DoH server response not OK: 0" logs, like to the point where it started ignoring the logs and at some point there was 2 logs on my router, that warning and my winbox logins...

Shared it with support, they said its not a mikrotik issue that its my certificates, i imported all the certs, activated all their certs and imported the Quad9 certs. Showed them that and the router logs again (it was the same) then i just got told that its an issue with Quad9 DoH.

Later i saw development 7.26 patchnotes and right after my support ticket there was one line that got my attention.

I honestly don't care to spend more time or troubleshoot it further, theres no point theres something wrong with either mikrotik way of handling it or Quad9, dont use their DoH. Simple.

bloodynetworker · October 18, 2026, 1:38pm

Wow! Thanks for sharing your knowledge on this! I probably would've investigated this myself further, if it weren't for your detailed insights. I should spare my time on this topic too if that's so.