DNS FWD intermittently returns NXDOMAIN until DNS cache is flushed

RouterOS
1

I am experiencing an intermittent issue with the RouterOS DNS FWD functionality. The same behaviour has been observed on multiple MikroTik routers using the same configuration pattern, all running firmware 7.23.1.

The routers act as local DNS resolvers for clients. Public DNS queries use the DNS servers configured under /ip dns, while queries for an internal DNS zone are forwarded to two dedicated DNS servers using a named DNS forwarder and a static FWD entry.

The configuration pattern is:

/ip dns
set allow-remote-requests=yes servers=,

/ip dns forwarders
add name="internal.example" dns-servers=,

/ip dns static
add name="internal.example" type=FWD forward-to="internal.example" match-subdomain=yes

Initially, this works correctly. Queries for hosts under internal.example are forwarded to the configured internal DNS servers and valid answers are returned.

After some time, however, the router enters a state where queries for the forwarded zone return NXDOMAIN.

For example:

nslookup host.internal.example

  • can't find host.internal.example: Non-existent domain

The following observations were made while the issue was present:

  • The client query reaches the MikroTik DNS resolver.
  • MikroTik immediately returns NXDOMAIN.
  • Packet capture shows that no corresponding DNS query is sent to either configured internal DNS server.
  • /ip dns cache print detail shows no matching entry.
  • /ip dns cache all print detail shows no matching positive or negative entry.
  • The FWD static entry remains enabled and correctly configured.
  • The named DNS forwarder remains enabled and correctly configured.
  • Disabling and re-enabling the static FWD entry does not restore operation.
  • Disabling and re-enabling the named DNS forwarder does not restore operation.
  • The internal DNS servers remain reachable and respond correctly when queried directly.

The only action that immediately restores normal operation is:

/ip dns cache flush

Immediately after the cache flush, the exact same query succeeds and is correctly forwarded:

nslookup host.internal.example

Name: host.internal.example
Address:

This is reproducible, and the key point is that no matching cache entry is visible before the flush. Nevertheless, flushing the DNS cache immediately resets the failure state.

Could you please confirm whether this is a known issue with DNS FWD or the DNS resolver/cache state? I would also appreciate guidance on any permanent workaround that preserves split-DNS operation, as periodically flushing the complete DNS cache is not an appropriate long-term solution.

2

Is your "forward-to" an IP address or an FQDN? (Your config fragments are pretty useless . . . ) Also, might there be any correlation between your DNS TTL and when this fails? Sounds like for some reason, the record(s) expire, but it never goes back to refresh.

3

This is my configuration.

/ip dns forwarders
add name="xxx.local" dns-servers=x.x.x.x, x.x.x.x

/ip dns static
add name="xxx.local" type=FWD forward-to="xxx.local" match-subdomain=yes

As for the DNS TTL, all queried records have a TTL of 1 hour, and this issue occurs way later, usually days. For now I'm sending all my queries to my DNS servers to bypass this issue, however this is not ideal.