firewall src add and dst add

Problem is, it doesn’t do what you think. You need the router to use the right resolver (i.e. not ISP’s) and client to use router (default is 192.168.88.1; you can have different config) as resolver. What actually happens is that when client gets 192.168.88.1 and tries to use it, dstnat forwards all client’s queries to 208.67.222.222:5353, so it completely bypasses router as resolver. But the router itself still uses whatever it has in “/ip dns” (so ultimately always ISP’s resolver), because dstnat does not apply to router’s own output.

There’s the ugly hack I mentioned before that can help with that. It really isn’t nice, but as a desperate solution it can work.