DNS FWD entry not working as expected

RouterOS General
1

When I set a static DNS entry:

name="example.com" type=A address=10.10.10.10 ttl=1d match-subdomain=yes

Then I verify:

:put [:resolve domain-name=test.example.com]`
10.10.10.10

All good.

But when I use a FWD-entry, because I want some other nameserver to handle a specific domain, it does not work:

name="example.com" type=FWD forward-to=10.23.45.10 ttl=1d match-subdomain=yes

It returns:

:put [:resolve domain-name=foo.example.com]
failure: dns name does not exist

But to verify, when I use resolve with explicit server param it resolves perfectly.

 :put [:resolve domain-name=foo.example.com server=10.23.45.10]
10.23.45.16

Is this a ROS bug or does FWD just not work how I would assume it works?
ROS: 7.8

2

Did you just forget to mention that you use DoH?

3

Yes, I did not mention that. I have configured a DoH server.

4

Didn’t you wonder how I knew that without a doubt?
I also assume you have NOT read the online help.
If you read the help, you’d instantly understand how I knew you were using DoH…

On synthesis, your FWD point to one DNS without certificate issued by one global CA, and, if you use the DoH, the FWD field make no sense.

5

Sry, just found that. DNS - RouterOS - MikroTik Documentation

DoH is not compatible with FWD-type static entries, in order to utilize FWD entries, DoH must not be configured.

I also assume you have NOT read the online help.

I do read the online help. But sometimes important infos are “hidden” in long sentences and I oversee that. I somehow struggle with the Confluence style too…

6

But there is someone who has read it and gives you a hand :wink:

7

And he only has one eye!!

8

all the more amazing!

9

The Eye of Barad-dûr
hqdefault.jpg

10

Just some history :wink:


Avatar 2014-2020
68609_old.png
Avatar 2021
68609_oggi.png
Avatar from 2022-02-24
68609_UA.png
Avatar for 2023-02-24
anniversario_ua.png
Avatar for 1st April 2023
1apr.png
Actual Avatar
xp_cat_UA.png
Is there a similarity to the second? :laughing:

11

So … in the last two years you made a transition from right to left? :open_mouth:

And only that … your hair became grey? Is that how old you are? :laughing:

12

The last is the old Windows XP user login picture icon, with a surprise if is zoomed :wink: (like the original…)

13

You can use dns over wireguard instead of doh. For example cloudflare warp with their dns servers.