Sebby
October 18, 2023, 9:22pm
41
+1. I’d be fine using the RouterOS resolver if it returned at least the AD bit in the response for use by my mail server for DANE checking. But it doesn’t. I can appreciate that validation as such is hard, but couldn’t we at least have proxying the DO and CD bits in queries and AD bits in responses from a configured DoH upstream? You can still cache the supported RR sets in responses—just make sure DNSSEC-enabled queries and replies are proxied direct.
Or, yeah, as others here have suggested, just use another resolver. Dnsmasq, for preference—then you can have tight DHCP and DNS integration, with DHCP-supplied hostnames registered automatically in DNS: a nice feature, if not absolutely necessary. But please don’t leave us with this half-baked resolver and make it necessary to run a dedicated machine on the network for functioning DNS resolution and questioning the whole point of an integrated router (or alternatively looking at other options that’ll just let you run Linux yourself).
nichky
October 18, 2023, 10:59pm
42
for now till MT add this feature, use container + adguard
Sebby
October 19, 2023, 9:51am
43
Do you know if the MikroTik DoH proxy is a separate listening interface that can be configured? Or does the container need to have DoH or DoT support itself as well?
pe1chl
October 19, 2023, 12:47pm
44
When going to the trouble of setting up a container with a good DNS resolver, I would not rely on the behavior of the existing DNS resolver in RouterOS.
Ralpha
May 23, 2026, 8:16pm
45
Come on MikroTik, Please add DNSSEC support for the DNS Cache. This thread has been open for 16 years.
I know RouerOS doesn't do DNSSEC. I like to do a little experiment.
Can someone running a linux system run this command.
dig +dnssec example.com 10.0.2.2
10.0.2.2 is my mikrotik router ip address.
Do you get a RRSIG key?
dig +dnssec example.com 10.0.2.2
; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> +dnssec example.com 10.0.2.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13017
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 65494
; COOKIE: 5a62f46f56a7e94a010000006a131c722808a022b857e1ea (good)
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 283 IN A 172.66.147.243
example.com. 283 IN A 104.20.23.154
example.com. 283 IN RRSIG A 13 2 300 20260525164226 20260523144226 34505 example.com. d/s4ka3qRq6/ojinSSTLZYfsvP83SvpmUteom+zkgioXhn89m968lekO HjNPXVw36CLzMjYbB1NmKIE2tpAMPQ==
;; Query time: 452 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Sun May 24 11:42:41 EDT 2026
;; MSG SIZE rcvd: 207
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 18246
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 65494
; COOKIE: 5a62f46f56a7e94a010000006a131c7297c8a0dce8575bd3 (good)
;; QUESTION SECTION:
;10.0.2.2. IN A
;; AUTHORITY SECTION:
. 10799 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2026052400 1800 900 604800 86400
. 10799 IN RRSIG SOA 8 0 86400 20260606050000 20260524040000 54393 . VmG9dovA11s/akRKU0hMo9qoGzAB+f9alSIOQ2eHn2aO7Br9ATMCvfJe TACmSEdRKUfvUuOUzKZZDHFua58DxXG5b1n2P30n7WgDhbEd2GpC+0uW 3BCCt39Bb8SvjE0JYOJjPWbRox98Wzh3mIvXen+caE4P7jZvfF4fTxHp 8ITNCE3+M7xjNExvszUsMrOWQaQGVEmTbP/BwzPrVtbSpM21GTvrjl5q qPMw58IwzWh+OvfUuy7YS4sYNd6uv2qziF6Zj8m4p2n1a7UVKZJ2PsSb VeBT6by8Fg34DPqb+6w2DH/K+n/egSs22Fsv6kHJBWLVjP61uA7FlLlW LNnH2w==
. 10799 IN RRSIG NSEC 8 0 86400 20260606050000 20260524040000 54393 . qmz21Ps0rCChKIv55fSq+fl31iP3eg7kxDFL1ZXcLUh9VTkQZ/a33XpX cGoPg/LVbn5VaiFu8TkL0jkApmCMCLpTgXwQOqIYthQhkURNp3l1BNLE hcxTvuInWoYBCuMJHXf4lblorM/C2PbRX6yJDONE0xj0R0d58+d6gnD6 ULMkZwUf9vT5teSwjmwd0pMkJ/JKxlqpd0Ml20ZR4nGUiUG95HPi37Ht oD2ng/zZ38lv5G0JgsJDiV/it6yW0JqHGhd5/N8wcT6qcrQeQNIzjf23 nx0BqqvLOOmZur/FcBXZM7mNnwBw73xdTKFqzK5vVfcD0B/baSiKvNoK 6uksJQ==
. 10799 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD
;; Query time: 33 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Sun May 24 11:42:41 EDT 2026
;; MSG SIZE rcvd: 738
dig +dnssec iana.org 10.0.2.2
; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> +dnssec iana.org 10.0.2.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41598
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 65494
; COOKIE: 785df86d58f7ecc4010000006a13255418e7f9cb16706c5a (good)
;; QUESTION SECTION:
;iana.org. IN A
;; ANSWER SECTION:
iana.org. 1823 IN A 192.0.43.8
iana.org. 1823 IN RRSIG A 13 2 3600 20260613094735 20260523152554 56343 iana.org. DR+0cvFMgIRWmX9Ad/C+Qte60uxEN7S291DTDPuMf5nE4sZFr8fLCUsw F4M5p0kWEs4B/6iQm8GHsyA1igX15w==
;; Query time: 35 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Sun May 24 12:20:35 EDT 2026
;; MSG SIZE rcvd: 185
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 11445
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 65494
; COOKIE: 785df86d58f7ecc4010000006a1325541005520dc6a86c2c (good)
;; QUESTION SECTION:
;10.0.2.2. IN A
;; AUTHORITY SECTION:
. 10799 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2026052400 1800 900 604800 86400
. 10799 IN RRSIG SOA 8 0 86400 20260606050000 20260524040000 54393 . VmG9dovA11s/akRKU0hMo9qoGzAB+f9alSIOQ2eHn2aO7Br9ATMCvfJe TACmSEdRKUfvUuOUzKZZDHFua58DxXG5b1n2P30n7WgDhbEd2GpC+0uW 3BCCt39Bb8SvjE0JYOJjPWbRox98Wzh3mIvXen+caE4P7jZvfF4fTxHp 8ITNCE3+M7xjNExvszUsMrOWQaQGVEmTbP/BwzPrVtbSpM21GTvrjl5q qPMw58IwzWh+OvfUuy7YS4sYNd6uv2qziF6Zj8m4p2n1a7UVKZJ2PsSb VeBT6by8Fg34DPqb+6w2DH/K+n/egSs22Fsv6kHJBWLVjP61uA7FlLlW LNnH2w==
. 10799 IN RRSIG NSEC 8 0 86400 20260606050000 20260524040000 54393 . qmz21Ps0rCChKIv55fSq+fl31iP3eg7kxDFL1ZXcLUh9VTkQZ/a33XpX cGoPg/LVbn5VaiFu8TkL0jkApmCMCLpTgXwQOqIYthQhkURNp3l1BNLE hcxTvuInWoYBCuMJHXf4lblorM/C2PbRX6yJDONE0xj0R0d58+d6gnD6 ULMkZwUf9vT5teSwjmwd0pMkJ/JKxlqpd0Ml20ZR4nGUiUG95HPi37Ht oD2ng/zZ38lv5G0JgsJDiV/it6yW0JqHGhd5/N8wcT6qcrQeQNIzjf23 nx0BqqvLOOmZur/FcBXZM7mNnwBw73xdTKFqzK5vVfcD0B/baSiKvNoK 6uksJQ==
. 10799 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD
;; Query time: 31 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Sun May 24 12:20:35 EDT 2026
;; MSG SIZE rcvd: 738
Thanks
$ dig +dnssec example.com 192.168.88.1
; <<>> DiG 9.20.23 <<>> +dnssec example.com 192.168.88.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5770
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 65494
;; QUESTION SECTION:
;example.com. IN A
;; ANSWER SECTION:
example.com. 3599 IN A 127.0.0.1
;; Query time: 62 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue May 26 21:54:58 CEST 2026
;; MSG SIZE rcvd: 67
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 64174
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 65494
;; QUESTION SECTION:
;192.168.88.1. IN A
;; AUTHORITY SECTION:
. 899 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2026052601 1800 900 604800 86400
. 899 IN RRSIG SOA 8 0 86400 20260608170000 20260526160000 54393 . sS4Nk1GSj+w93I3bjFjkljho8UHXNci00Bs6aDmCSlpsamQDXWc/VmOg 70zBYs70EDkkn7npwltpmDsHXslb5lvNBMbcR8wVd+Vczad1UvDDTWdC C5OR/sx7TzLJkWLsrAMzEsGl7mlUXafjPkKD+LpFhVmN80JYG+ZjmXOE yXTseE7INCsV2clX9hze0IoMX7S2K5iQgl8ZQ1nCMlB2nWC0P9gRbY5g HBXNL9IEjwn4uBa7IE7XDWRIccufLfu2x3Vo+y0We1u3jZ7jxHzIpXyk 94RMLNz9SH2avhoJI0b7ZtCqUivEBGOw/vPhU7wEWblXWsVi2sP8dAPA yz7/8A==
. 899 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD
. 899 IN RRSIG NSEC 8 0 86400 20260608170000 20260526160000 54393 . E59YAhuEfzkT6qQ0Ipx+egDHlfSD0pU1F2PMDQKKeFBxZz/jE2yJonPP bIzzCWY6Ia9xPTmnMNykRb33P5ar2v8CeC5Fone0o/1QAt7fx8E+Njsl F7scc+u8cVYJq5AXgvtExyzMLK2TZIbVfmeDEfhir8h4XVlX9c/Xv1Fl DYz2UexGLxVg41K9LyZBEMv9tWS0Aes7uEr2fqnbNTdF4QKNbtJp25ey E7zSf0bOLIJeCYeLCKvOB/T9LOJHAF0EjOAP4aqDzD6O9S4z+rj4eZOp llpJ3m6gJn0i8G59yUXrolUoCESNMsFe33NI0lgtc39yMcOdnKuP7sG7 FRZ9BA==
;; Query time: 62 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue May 26 21:54:59 CEST 2026
;; MSG SIZE rcvd: 714
Now add these certificates.
DNSSEC.zip (13.4 KB)
Then run the command again and see if you get the RRSIG key.
Thanks
To be honest I don't think we will ever get DNSSEC support. It's basically dead as an end to end validation chain solution. It's benefits were mostly replaced by TLS, CT, DoH/DoT, ACME, etc.
Can you test on your end just to verify. So, I know that I'm not going crazy.
You can remove the certs after the test.
Thanks
I've just registered and my replies require manual approves from moderators. I will try later
save yourself the headache, .5 just works .103 Mikrotik latest does not!
Technitium test
dig @192.168.0.5 +dnssec example.com
; <<>> DiG 9.20.22 <<>> @192.168.0.5 +dnssec example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13135
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
CHR test
dig @192.168.0.103 +dnssec example.com
; <<>> DiG 9.20.22 <<>> @192.168.0.103 +dnssec example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10995
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0