DNS problem

atbizz · August 20, 2024, 8:31am

Hi,
Mikrotik OS 7.15.3, router C53UiG+5HPaxD2HPaxD,
DNS server responds differently to the same requests depending on whether DOH used or not, causing a resolving problems on clients.

(static A record on DNS: box.lan = 192.168.1.5)

If DNS servers = 1.1.1.1

nslookup box.lan
Server:         127.0.0.11
Address:        127.0.0.11:53

Non-authoritative answer:
Name:   box.lan
Address: 192.168.1.5

Non-authoritative answer:

if Use DOH server https://1.1.1.1/dns-query:

nslookup box.lan
Server:         127.0.0.11
Address:        127.0.0.11:53

Non-authoritative answer:
Name:   box.lan
Address: 192.168.1.5

** server can't find box.lan: NXDOMAIN

Incorrect DNS reply if no AAAA record, this misbehavior cause problems in docker…

optio · August 20, 2024, 4:31pm

nslookup box.lan
Server: 127.0.0.11
Address: 127.0.0.11:53
I somehow doubt this is response from ROS DNS:..

If DNS IP for container is not set (dns config), in /etc/resolv.conf file in container nameserver is set to upstream DNS IP(s) of ROS DNS (servers or dynamic-servers), not ROS DNS IP, you need to manually specify in dns container config ROS DNS IP (gateway IP) to be used for container (to be able to resolve static entries set in ROS DNS for some reason), also make sure that container have input allowed for port 53 if container connections are filtered.

atbizz · August 21, 2024, 4:59pm

More correct version from host (previous were from docker container running on host box.lan):

nslookup box.lan
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   box.lan
Address: 192.168.1.5

And with DOH:

nslookup box.lan
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   box.lan
Address: 192.168.1.5
** server can't find box.lan: NXDOMAIN

Everything absolutely the same like inside container, because:

cat /etc/resolv.conf
# Resolver configuration file.
# See resolv.conf(5) for details.
nameserver 192.168.1.1
domain lan
search lan

and docker:

cat /etc/docker/daemon.json
{
  "dns" : ["192.168.1.1"],
  "dns-search" : ["lan"],
  ...
}

192.168.1.1 - mikrotik router with DNS server.

optio · August 21, 2024, 6:53pm

Yes, can reproduce this, it seems this is a bug in ROS DNS.

Without DoH:

$ dig A @192.168.100.1 tvbox.lan

; <<>> DiG 9.10.6 <<>> A @192.168.100.1 tvbox.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30291
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;tvbox.lan.			IN	A

;; ANSWER SECTION:
tvbox.lan.		86400	IN	A	192.168.100.20

;; Query time: 45 msec
;; SERVER: 192.168.100.1#53(192.168.100.1)
;; WHEN: Wed Aug 21 20:44:50 CEST 2024
;; MSG SIZE  rcvd: 43


$ dig AAAA @192.168.100.1 tvbox.lan

; <<>> DiG 9.10.6 <<>> AAAA @192.168.100.1 tvbox.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35536
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;tvbox.lan.			IN	AAAA

;; Query time: 62 msec
;; SERVER: 192.168.100.1#53(192.168.100.1)
;; WHEN: Wed Aug 21 20:44:53 CEST 2024
;; MSG SIZE  rcvd: 27

NOERROR is returned for A and AAAA queries

With DoH:

$ dig A @192.168.100.1 tvbox.lan

; <<>> DiG 9.10.6 <<>> A @192.168.100.1 tvbox.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23932
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;tvbox.lan.			IN	A

;; ANSWER SECTION:
tvbox.lan.		86400	IN	A	192.168.100.20

;; Query time: 44 msec
;; SERVER: 192.168.100.1#53(192.168.100.1)
;; WHEN: Wed Aug 21 20:41:57 CEST 2024
;; MSG SIZE  rcvd: 43


$ dig AAAA @192.168.100.1 tvbox.lan

; <<>> DiG 9.10.6 <<>> AAAA @192.168.100.1 tvbox.lan
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 38456
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;tvbox.lan.			IN	AAAA

;; AUTHORITY SECTION:
.			86383	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2024082101 1800 900 604800 86400

;; Query time: 50 msec
;; SERVER: 192.168.100.1#53(192.168.100.1)
;; WHEN: Wed Aug 21 20:42:03 CEST 2024
;; MSG SIZE  rcvd: 102

NOERROR is returned for A, but NXDOMAIN for AAAA query

monotype6 · August 22, 2024, 2:57pm

I actually got the same problem, just that i only have AAAA records and no A records. I think the mikrotik, if doh is enabled, treats the A and AAAA requests seperately and therefore forwards the request for which it doesnt have an entry to the doh server. a public dns then obviously returns nxdomain and the mikrotik is sending this to the client/docker container.
i hope they fix this, but it should be possible as it works with normal dns servers. just not for doh.

dksoft · September 13, 2024, 8:12am

Thanks @atbizz for the solution!

I can confirm the problem which breaks certain Alpine based installations. Removing DoH fixes it for now.
Here is a description what is causing the problem: https://www.home-assistant.io/more-info/unsupported/dns_server/

atbizz · September 10, 2025, 2:11pm

ROS 7.19.4 and problem with DOH DNS still exists, how to push a solution?

optio · September 10, 2025, 4:28pm

If you have device which can run containers try with some DNS server (ie. Unbound) running in container.