Probably because it was easier?
I have to apologize for calling hamburges with McDonalds unhealty.
Eating one McDonalds hamburger yourself does not mean that all McDonalds hamburger are unhealthy also.
Just trying to be inculsive. 
Its called JUNK food for a reason.
You were right the first time.
If one is predisposed to eating at McD as a primary food source, I will help you in assisted ā¦, for a lot less $$ and a lot quicker (no suffering for those last 10-20 years).
What do you mean? How did you add a second DoH server?
If you mean the script you posted that is not adding a second DoH server. It is just replacing the one DoH server 
This contains GlobalSign Root CA - R2, among others, which is what dns.google uses: https://curl.haxx.se/ca/cacert.pem
It depends on the point if view. As the script monitors the responsiveness of the primary server and replaces it in the configuration by the secondary one whenever it stops responding, and puts back the primary one once it starts responding again, it can be seen as āadding a second oneā. Yes, it modifies configuration (so writes to flash), yes, it has to be spawned quite often to be useful (so it wastes some CPU), but it serves the purpose.
And there is a minor mistake in it which Iāve noticed later, there should be a plain & at the place of the %26. Minor because the server does respond (so the monitoring goal is met) but provides no Answer section with the %26 in place.
What is worse is that the Cloudflare does respond whereas Google returns 400 Bad Request (even with the &).
Just as Sindy writes. Using a fail-over script to a second server.
What can also be done, is to setup three routes. One with two DNS points to the two other. Then the two other running each own DoH.
Will test the google cert
This worked, but installed 137 Certificates 
Do I need all? Can I see what is use?
You only need the root certificate of the service you want to use.
And from this list what is the root certificate needed for DoH to work?
1 T cacert.pem_0 GlobalSign Root CA ebd41040e4bb3ec742c9e38...
2 L T cacert.pem_1 GlobalSign ca42dd41745fd0b81eb9023...
3 T cacert.pem_2 VeriSign Class 3 Public... eb04cf5eb1f39afa762f2bb...
4 T cacert.pem_3 Entrust.net Certificati... 6dc47172e01cbcb0bf62580...
5 T cacert.pem_4 Baltimore CyberTrust Root 16af57a9f676b0ab126095a...
6 ET cacert.pem_5 AddTrust External CA Root 687fa451382278fff0c8b11...
7 T cacert.pem_6 Entrust Root Certificat... 73c176434f1bc6d5adf45b0...
8 T cacert.pem_7 GeoTrust Global CA ff856a2d251dcd88d36656f...
9 T cacert.pem_8 GeoTrust Universal CA a0459b9f63b22559f5fa5d4...
10 T cacert.pem_9 GeoTrust Universal CA 2 a0234f3bc8527ca5628eec8...
11 L T cacert.pem_10 AAA Certificate Services d7a7a0fb5d7e2731d771e94...
12 T cacert.pem_11 QuoVadis Root Certifica... a45ede3bbbf09c8ae15c72e...
13 T cacert.pem_12 QuoVadis Root CA 2 85a0dd7dd720adb7ff05f83...
14 T cacert.pem_13 QuoVadis Root CA 3 18f1fc7f205df8adddeb7fe...
15 T cacert.pem_14 e75e72ed9f560eec6eb4800...
16 T cacert.pem_15 Sonera Class2 CA 7908b40314c138100b518d0...
17 L T cacert.pem_16 XRamp Global Certificat... cecddc905099d8dadfc5b1d...
18 T cacert.pem_17 c3846bf24b9e93ca64274c0...
19 T cacert.pem_18 1465fa205397b876faa6f0a...
20 T cacert.pem_19 7600295eefe85b9e1fd624d...
21 T cacert.pem_20 DigiCert Assured ID Roo... 3e9099b5015e8f486c00bce...
22 T cacert.pem_21 DigiCert High Assurance... 7431e5f4c3c1ce4690774f0...
23 T cacert.pem_22 DST Root CA X3 0687260331a72403d909f10...
24 T cacert.pem_23 SwissSign Gold CA - G2 62dd0be9b9f50a163ea0f8e...
25 T cacert.pem_24 SwissSign Silver CA - G2 be6c4da2bbb9ba59b6f3939...
26 T cacert.pem_25 GeoTrust Primary Certif... 37d51006c512eaab626421f...
27 T cacert.pem_26 thawte Primary Root CA 8d722f81a9c113c0791df13...
28 T cacert.pem_27 VeriSign Class 3 Public... 9acfab7e43c8d880d06b262...
29 L T cacert.pem_28 SecureTrust CA f1c1b50ae5a20dd8030ec9f...
30 L T cacert.pem_29 Secure Global CA 4200f5043ac8590ebb527d2...
31 L T cacert.pem_30 COMODO Certification Au... 0c2cd63df7806fa399ede80...
32 L T cacert.pem_31 Network Solutions Certi... 15f0ba00a3ac7af3ac884c0...
33 T cacert.pem_32 COMODO ECC Certificatio... 1793927a0614549789adce2...
34 T cacert.pem_33 OISTE WISeKey Global Ro... 41c923866ab4cad6b7ad578...
35 T cacert.pem_34 Certigna e3b6a2db2ed7ce48842f7ac...
36 L T cacert.pem_35 Cybertrust Global Root 960adf0063e96356750c296...
37 T cacert.pem_36 c0a6f4dc63a24bfdcf54ef2...
38 T cacert.pem_37 eaa962c4fa4a6bafebe4151...
39 T cacert.pem_38 GeoTrust Primary Certif... b478b812250df878635c2aa...
40 T cacert.pem_39 thawte Primary Root CA ... a4310d50af18a6447190372...
41 T cacert.pem_40 thawte Primary Root CA ... 4b03f45807ad70f21bfc2ca...
42 T cacert.pem_41 GeoTrust Primary Certif... 5edb7ac43b82a06a8761e8d...
43 T cacert.pem_42 VeriSign Universal Root... 2399561127a57125de8cefe...
44 T cacert.pem_43 VeriSign Class 3 Public... 69ddd7ea90bb57c93e135dc...
45 T cacert.pem_44 6c61dac3a2def031506be03...
46 ET cacert.pem_45 Staat der Nederlanden R... 668c83947da63b724bece17...
47 T cacert.pem_46 Hongkong Post Root CA 1 f9e67d336c51002ac054c63...
48 T cacert.pem_47 SecureSign RootCA11 bf0feefb9e3a581ad5f9e9d...
49 T cacert.pem_48 Microsec e-Szigno Root ... email:info@e-szigno.hu 3c5f81fea5fab82c64bfa2e...
50 T cacert.pem_49 GlobalSign cbb522d7b7f127ad6a01138...
51 T cacert.pem_50 Autoridad de Certificac... 04048028bf1f2864d48f9ad...
52 T cacert.pem_51 Izenpe.com email:info@izenpe.com 2530cc8e98321502bad96f9...
53 T cacert.pem_52 Chambers of Commerce Ro... 063e4afac491dfd332f3089...
54 T cacert.pem_53 Global Chambersign Root... 136335439334a7698016a0d...
55 T cacert.pem_54 Go Daddy Root Certifica... 45140b3247eb9cc8c5b4f0d...
56 T cacert.pem_55 Starfield Root Certific... 2ce1cb0bf9d2f9e102993fb...
57 T cacert.pem_56 Starfield Services Root... 568d6905a2c88708a4b3025...
58 T cacert.pem_57 AffirmTrust Commercial 0376ab1d54c5f9803ce4b2e...
59 T cacert.pem_58 AffirmTrust Networking 0a81ec5a929777f145904af...
60 T cacert.pem_59 AffirmTrust Premium 70a73f7f376b60074248904...
61 T cacert.pem_60 AffirmTrust Premium ECC bd71fdf6da97e4cf62d1647...
62 T cacert.pem_61 Certum Trusted Network CA 5c58468d55f58e497e74398...
63 T cacert.pem_62 TWCA Root Certification... bfd88fe1101c41ae3e801bf...
64 T cacert.pem_63 513b2cecb810d4cde5dd853...
65 T cacert.pem_64 EC-ACC email:ec_acc@catcert.net 88497f01602f3154246ae28...
66 T cacert.pem_65 Hellenic Academic and R... bc104f15a48be709dca542a...
67 T cacert.pem_66 Actalis Authentication ... 55926084ec963a64b96e2ab...
68 T cacert.pem_67 c1b48299aba5208fe9630ac...
69 T cacert.pem_68 Buypass Class 2 Root CA 9a114025197c5bb95d94e63...
70 T cacert.pem_69 Buypass Class 3 Root CA edf7ebbca27a2a384d387b7...
71 T cacert.pem_70 T-TeleSec GlobalRoot Cl... fd73dad31c644ff1b43bef0...
72 T cacert.pem_71 EE Certification Centre... 3e84ba4342908516e77573c...
73 L T cacert.pem_72 D-TRUST Root Class 3 CA... 49e7a442acf0ea628705005...
74 L T cacert.pem_73 D-TRUST Root Class 3 CA... eec5496b988ce98625b9340...
75 T cacert.pem_74 CA Disig Root R2 e23d4a036d7b70e9f595b14...
76 L T cacert.pem_75 ACCVRAIZ1 email:accv@accv.es 9a6ec012e1a7da9dbe34194...
77 T cacert.pem_76 TWCA Global Root CA 59769007f7685d0fcd50872...
78 T cacert.pem_77 TeliaSonera Root CA v1 dd6936fe21f8f077c123a1a...
79 T cacert.pem_78 E-Tugra Certification A... b0bfd52bb0d7d9bd92bf5d4...
80 T cacert.pem_79 T-TeleSec GlobalRoot Cl... 91e2f5788d5810eba7ba587...
81 T cacert.pem_80 Atos TrustedRoot 2011 f356bea244b7a91eb35d53c...
82 T cacert.pem_81 QuoVadis Root CA 1 G3 8a866fd1b276b57e578e921...
83 T cacert.pem_82 QuoVadis Root CA 2 G3 8fe4fb0af93a4d0d67db0be...
84 T cacert.pem_83 QuoVadis Root CA 3 G3 88ef81de202eb018452e43f...
85 T cacert.pem_84 DigiCert Assured ID Roo... 7d05ebb682339f8c9451ee0...
86 T cacert.pem_85 DigiCert Assured ID Roo... 7e37cb8b4c47090cab36551...
87 T cacert.pem_86 DigiCert Global Root G2 cb3ccbb76031e5e0138f8dd...
88 T cacert.pem_87 DigiCert Global Root G3 31ad6648f8104138c738f39...
89 T cacert.pem_88 DigiCert Trusted Root G4 552f7bdcf1a7af9e6ce6720...
90 T cacert.pem_89 COMODO RSA Certificatio... 52f0e1c4e58ec629291b603...
91 T cacert.pem_90 USERTrust RSA Certifica... e793c9b02fd8aa13e21c312...
92 T cacert.pem_91 USERTrust ECC Certifica... 4ff460d54b9c86dabfbcfc5...
93 T cacert.pem_92 GlobalSign bec94911c2955676db6c0a5...
94 T cacert.pem_93 GlobalSign 179fbc148a3dd00fd24ea13...
95 T cacert.pem_94 Staat der Nederlanden R... 3c4fb0b95ab8b30032f432b...
96 T cacert.pem_95 Staat der Nederlanden E... 4d2491414cfe956746ec4ce...
97 T cacert.pem_96 IdenTrust Commercial Ro... 5d56499be4d2e08bcfcad08...
98 T cacert.pem_97 IdenTrust Public Sector... 30d0895a9a448a262091635...
99 T cacert.pem_98 Entrust Root Certificat... 43df5774b03e7fef5fe40d9...
100 T cacert.pem_99 Entrust Root Certificat... 02ed0eb28c14da45165c566.>
101 T cacert.pem_100 CFCA EV ROOT 5cc3d78e4e1d5e45547a04e.>
102 T cacert.pem_101 OISTE WISeKey Global Ro... 6b9c08e86eb0f767cfad65c.>
103 T cacert.pem_102 SZAFIR ROOT CA2 a1339d33281a0b56e557d3d.>
104 T cacert.pem_103 Certum Trusted Network ... b676f2eddae8775cd36cb0f.>
105 T cacert.pem_104 Hellenic Academic and R... a040929a02ce53b4acf4f2f.>
106 T cacert.pem_105 Hellenic Academic and R... 44b545aa8a25e65a73ca15d.>
107 T cacert.pem_106 ISRG Root X1 96bcec06264976f37460779.>
108 T cacert.pem_107 ebc5570c29018c4d67b1aa1.>
109 T cacert.pem_108 Amazon Root CA 1 8ecde6884f3d87b1125ba31.>
110 T cacert.pem_109 Amazon Root CA 2 1ba5b2aa8c65401a8296011.>
111 T cacert.pem_110 Amazon Root CA 3 18ce6cfe7bf14e60b2e347b.>
112 T cacert.pem_111 Amazon Root CA 4 e35d28419ed02025cfa6903.>
113 T cacert.pem_112 LuxTrust Global Root 2 54455f7129c20b1447c418f.>
114 T cacert.pem_113 TUBITAK Kamu SM SSL Kok... 46edc3689046d53a453fb31.>
115 T cacert.pem_114 GDCA TrustAUTH R5 ROOT bfff8fd04433487d6a8aa60.>
116 T cacert.pem_115 TrustCor RootCert CA-1 d40e9c86cd8fe468c177695.>
117 T cacert.pem_116 TrustCor RootCert CA-2 0753e940378c1bd5e3836e3.>
118 T cacert.pem_117 TrustCor ECA-1 5a885db19c01d912c575938.>
119 T cacert.pem_118 SSL.com Root Certificat... 85666a562ee0be5ce925c1d.>
120 T cacert.pem_119 SSL.com Root Certificat... 3417bb06cc6007da1b961c9.>
121 T cacert.pem_120 SSL.com EV Root Certifi... 2e7bf16cc22485a7bbe2aa8.>
122 T cacert.pem_121 SSL.com EV Root Certifi... 22a2c1f7bded704cc1e701b.>
123 T cacert.pem_122 GlobalSign 2cabeafe37d06ca22aba739.>
124 T cacert.pem_123 OISTE WISeKey Global Ro... 8560f91c3624daba9570b5f.>
125 T cacert.pem_124 GTS Root R1 2a575471e31340bc21581cb.>
126 T cacert.pem_125 GTS Root R2 c45d7bb08e6d67e62e42351.>
127 T cacert.pem_126 GTS Root R3 15d5b8774619ea7d54ce1ca.>
128 T cacert.pem_127 GTS Root R4 71cca5391f9e794b0480253.>
129 T cacert.pem_128 UCA Global G2 Root 9bea11c976fe014764c1be5.>
130 T cacert.pem_129 UCA Extended Validation... d43af9b35473755c9684fc0.>
131 L T cacert.pem_130 Certigna Root CA d48d3d23eedb50a459e5519.>
132 T cacert.pem_131 emSign Root CA - G1 40f6af0346a99aa1cd1d555.>
133 T cacert.pem_132 emSign ECC Root CA - G3 86a1ecba089c4a8d3bbe273.>
134 T cacert.pem_133 emSign Root CA - C1 125609aa301da0a249b97a8.>
135 T cacert.pem_134 emSign ECC Root CA - C3 bc4d809b15189d78db3e1d8.>
136 T cacert.pem_135 Hongkong Post Root CA 3 5a2fc03f0c83b090bbfa406.>
137 T cacert.pem_136 Entrust Root Certificat... db3517d1f6732a2d5ab97c5.>
Open https://dns.google/dns-query in a browser. Youāll get a 400 Bad Request, but that doesnāt matter, there will be the padlock icon next to the url, click it and get to the certificate details to see the root CA certificate which signs the server one (the exact steps depend on browser).
The above is only true unless you have a spyware (antivirus) installed on your PC, which performs MITM attacks to all TLS traffic so that it could inspect the contents you download for malware.
Trail and error gave me the second certificate installed is the only needed one.
Name: cacert.pem_1
Issuer: OU=GlobalSign Root CA - R2,O=GlobalSign,CN=GlobalSign
Iām using the script and it works well, Iāve imported global certificates and tested several DoH servers but you always get an error as a response.
I set the scheduling every minute and had the results written on an external sacrificial MMC card, not to fry the tik flash.
When mentioning frying the flash, I had in mind the basic 6.47 which some users reports to generate thousands of sector writes without an apparent reason, not writing the fetched file to a flash - on my SOHO devices, files are stored in RAM unless you explicitly place them to flash.
I donāt understand what you mean by āworks wellā and āyou always get an errorā in the same sentence, can you elaborate?
For those who have DoH configured with CloudFlare, does first test "āSecure DNSā shows to you as a green?
https://www.cloudflare.com/ssl/encrypted-sni/
Thanks
I thought the result file was written on mikrotikās hdd, so I moved it to the external MMC.
The script always populates the mikrotik DNS cache even when the DOH cloudflare fails.
For the query response errors I thought about this .
Yes.
Have problem with that, I followed the nromis manuals, and I am unable to get First test green. Any recommendations? What should I have in DNS - Static, what should I have DHCP Server - Networks - DNS Servers?
Nothing if you use https://1.1.1.1/dns-query as DoH Server.
Or /ip dns static add address=1.1.1.1 name=cloudflare-dns.com
if you use https://cloudflare-dns.com/dns-query
Your routerās IP
Also make sure, that you donāt have any dynamic servers.
on linux to control the dns i do this, reboot the connection and control with nmcli device show myinterface | grep IP4