IPv6 DHCPv6 Issues on MikroTik L009

RouterOS General
1

Hi all.

I’m having trouble setting up IPv6 on my MikroTik L009UiGS-2HaxD router, which replaced a Ubiquiti AmpliFi that worked out of the box.

Despite multiple configuration attempts, I’m seeing UnSpecFail status errors and can’t seem to acquire a stable IPv6 address and prefix.

I’d prefer not to hardcode addresses but am running out of options.

Network Setup

Now:

ISP → fiber box → MikroTik L009UiGS-2HaxD (sfp1)

Previously:

ISP → fiber box → fiber switch → Ubiquiti AmpliFi (RJ45)

Routerbord information

routerboard: yes
model: L009UiGS-2HaxD
serial-number: redacted
firmware-type: ipq5000
factory-firmware: 7.12
current-firmware: 7.16.1
upgrade-firmware: 7.16.1

IPv6 configuration

/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept ICMPv6 after RAW" protocol=icmpv6
add action=accept chain=input comment="defconf: accept established,related" connection-state=established,related
add action=accept chain=input comment="defconf: accept UDP traceroute" dst-port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6 after RAW" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN

/ipv6 nd
set [ find default=yes ] advertise-dns=no disabled=yes managed-address-configuration=yes mtu=1500 other-configuration=yes ra-delay=5s ra-interval=5s-30s ra-lifetime=none reachable-time=5m
add advertise-dns=no interface=sfp1 ra-lifetime=none reachable-time=5m

/ipv6 nd prefix default
set preferred-lifetime=20m valid-lifetime=12h

/ipv6 settings
set accept-redirects=no accept-router-advertisements=yes max-neighbor-entries=4096

Findings

I have confirmed with my ISP that they hand out a ::/56 prefix.

Sometimes I receive a link-local address that is added as a gateway in (IPv6 Route List) as DAg with a distance of 1.

dhcp log from when dhcp client runs

1:34:32 dhcp,debug,packet send sfp1 -> ff02::1:2%13 
11:34:32 dhcp,debug,packet type: solicit 
11:34:32 dhcp,debug,packet transaction-id: be0318 
11:34:32 dhcp,debug,packet  -> clientid:   00030001 789a18fc 6dd0 
11:34:32 dhcp,debug,packet  -> ia_na:  
11:34:32 dhcp,debug,packet    t1: 0 
11:34:32 dhcp,debug,packet    t2: 0 
11:34:32 dhcp,debug,packet    id: 0xa 
11:34:32 dhcp,debug,packet  -> oro: 23  
11:34:32 dhcp,debug,packet  -> elapsed_time: 0 
11:34:32 dhcp,debug,packet  -> ia_pd:  
11:34:32 dhcp,debug,packet    t1: 0 
11:34:32 dhcp,debug,packet    t2: 0 
11:34:32 dhcp,debug,packet    id: 0xa 
11:34:32 dhcp,debug,packet recv client: sfp1 fe80::redacted -> fe80::redacted
11:34:32 dhcp,debug,packet type: advertise 
11:34:32 dhcp,debug,packet transaction-id: be0318 
11:34:32 dhcp,debug,packet  -> clientid:   00030001 789a18fc 6dd0 
11:34:32 dhcp,debug,packet  -> serverid:   00010001 27639377 00505687 fc2c 
11:34:32 dhcp,debug,packet  -> ia_na:  
11:34:32 dhcp,debug,packet    t1: 3600 
11:34:32 dhcp,debug,packet    t2: 7200 
11:34:32 dhcp,debug,packet    id: 0xa 
11:34:32 dhcp,debug,packet   -> ia_addr:  
11:34:32 dhcp,debug,packet     address: 2001:redacted
11:34:32 dhcp,debug,packet     valid time: 86400 
11:34:32 dhcp,debug,packet     pref. time: 54000 
11:34:32 dhcp,debug,packet  -> status: 1 - failed 
11:34:32 dhcp,debug,packet  -> dns_servers:  
11:34:32 dhcp,debug,packet     2001:redacted
11:34:32 dhcp,debug,packet     2001:redacted
11:34:32 dhcp,debug,packet  -> ia_pd:  
11:34:32 dhcp,debug,packet    t1: 3600 
11:34:32 dhcp,debug,packet    t2: 7200 
11:34:32 dhcp,debug,packet    id: 0xa 
11:34:32 dhcp,debug,packet   -> ia_prefix:  
11:34:32 dhcp,debug,packet     prefix: 2001:redacted::/56 
11:34:32 dhcp,debug,packet     valid time: 86400 
11:34:32 dhcp,debug,packet     pref. time: 54000

Screenshots from dump

Request

Response

UnSpecFail reference (RFC3315)

If a server receives a message that contains options it should not
contain (such as an Information-request message with an IA option),
is missing options that it should contain, or is otherwise not valid,
it MAY send a Reply (or Advertise as appropriate) with a Server
Identifier option, a Client Identifier option if one was included in
the message and a Status Code option with status UnSpecFail.

Reference threads

http://forum.mikrotik.com/t/dhcpv6-with-ia-id-and-ia-pd/150706/1
http://forum.mikrotik.com/t/dhcpv6-client-over-pppoe-cannot-get-prefix-or-address/126804/1
https://forum.opnsense.org/index.php?topic=20369.0
https://michael.stapelberg.ch/posts/2021-05-28-configured-and-returned-mikrotik-ccr2004-for-fiber7/#modify-the-ipv6-duid
https://community.tp-link.com/en/smart-home/forum/topic/530826?replyId=1048964
https://community.ui.com/questions/UDMpro-gets-no-IPv6-lease-prefix/223ecade-4561-4926-8c2f-2a3fafa19008
https://www.reddit.com/r/mikrotik/comments/bjxren/home_ipv6_help/

2

Having a link local address for the default gateway is normal. Provide all of your IPv6 configuration, not just part of it - commonly the DHCP client settings should not add a default route and only request a prefix, not an address, also there should be no /ipv6 nd entry for the interface providing the WAN connection.

3

Hey. I did a /ipv6 export. If I do a /export I don’t see anything else than what I have already added here.

I feel like I have tried with every option.

4

There is no sign of any /ipv6 address or /ipv6 dhcp-client in the export yet you have DHCPv6 logging data

5

ipv6 dhcp-client settings

/ipv6 dhcp-client
add add-default-route=yes comment="isp prefix" interface=sfp1 pool-name=isp prefix-hint=::/56 rapid-commit=no request=address,prefix use-interface-duid=yes use-peer-dns=no

ipv6 neighbor

[admin@MikroTik] > /ipv6/neighbor/print 
Flags: R - router 
 0 R address=fe80::redacted interface=sfp1 mac-address=22:22:00:01:00:01 status="stale"

ipv6 addresses

[admin@MikroTik] > /ipv6/address/print 
Flags: D - DYNAMIC; L - LINK-LOCAL
Columns: ADDRESS, INTERFACE, ADVERTISE
 #    ADDRESS                       INTERFACE  ADVERTISE
 0 D  ::1/128                       lo         no       
 1 DL fe80::7a9a:18ff:fefc:6dd8/64  sfp1       no       
 2 DL fe80::7a9a:18ff:fefc:6dd9/64  br         no

I always receive a status: 1 - failed error from the gateway router in the dhcp logs. It does not matter if I only try to request an address or address+prefix or prefix.

13:24:19 dhcp,debug,packet recv client: sfp1 fe80::redacted -> fe80::7a9a:18ff:fefc:6dd8 
13:24:19 dhcp,debug,packet type: reply 
13:24:19 dhcp,debug,packet transaction-id: 0a446f 
13:24:19 dhcp,debug,packet  -> clientid:   00030001 789a18fc 6dd8 
13:24:19 dhcp,debug,packet  -> serverid:   00010001 27639377 00505687 fc2c 
13:24:19 dhcp,debug,packet  -> ia_na:  
13:24:19 dhcp,debug,packet    t1: 3600 
13:24:19 dhcp,debug,packet    t2: 7200 
13:24:19 dhcp,debug,packet    id: 0xa 
13:24:19 dhcp,debug,packet   -> ia_addr:  
13:24:19 dhcp,debug,packet     address: 2001:redacted
13:24:19 dhcp,debug,packet     valid time: 78351 
13:24:19 dhcp,debug,packet     pref. time: 45951 
13:24:19 dhcp,debug,packet  -> status: 1 - failed 
13:24:19 dhcp,debug,packet send sfp1 -> ff02::1:2%13 
13:24:19 dhcp,debug,packet type: solicit 
13:24:19 dhcp,debug,packet transaction-id: 23e56e 
13:24:19 dhcp,debug,packet  -> clientid:   00030001 789a18fc 6dd8 
13:24:19 dhcp,debug,packet  -> ia_na:  
13:24:19 dhcp,debug,packet    t1: 0 
13:24:19 dhcp,debug,packet    t2: 0 
13:24:19 dhcp,debug,packet    id: 0xa 
13:24:19 dhcp,debug,packet  -> elapsed_time: 0
6

Not sure if it helps or not, but this is what I’m using for DHCP client settings (albeit on PPPoE interface):

/ipv6 dhcp-client
add interface=internet-pppoe pool-name=public-ipv6 pool-prefix-length=60 prefix-hint=::/56 request=prefix use-peer-dns=no
7

Unfortunately not, but thanks for trying.

Either MikroTik or my ISP is doing something wrong and they can’t seem to get this to work. I assume that the IPv6 was assigned in another way using my old Ubiquiti AmpliFI device. I will try and capture the DHCP traffic using the old Ubiquiti device someday but at the moment I just disabled IPv6 and continued with life.. Too much time spent on this matter…

Props to the support team though for investigating this and for trying to fix this issue!

8

@bitflow This is what I have got with Google fiber ISP (connected on WAN1 - sfp-sfpplus1, nothing’s connected on WAN2-Failover) - hope this helps you. The setup is on CCR-2004-1G-12S+2XS setup to work as gateway router with services : hotspot, CAPsMANv1, CAPsMANv2, VLANs, etc.

It’s working correctly as desired so far.

IPv6 SETTINGS:

/ipv6/settings/print
                     disable-ipv6: no                        
                          forward: yes                       
            multipath-hash-policy: l3                        
                 accept-redirects: yes-if-forwarding-disabled
     accept-router-advertisements: yes                       
  accept-router-advertisements-on: all                       
       disable-link-local-address: no                        
   stale-neighbor-detect-interval: 30                        
           stale-neighbor-timeout: 60                        
             min-neighbor-entries: 4096                      
        soft-max-neighbor-entries: 8192                      
             max-neighbor-entries: 16384                     
                  allow-fast-path: yes                       
            ipv6-fast-path-active: no                        
           ipv6-fast-path-packets: 0                         
             ipv6-fast-path-bytes: 0                         
            ipv6-fasttrack-active: yes                       
           ipv6-fasttrack-packets: 731772                    
             ipv6-fasttrack-bytes: 972189037

IPv6 ADDRESSES:

/ipv6/address/print
Flags: X - DISABLED, I - INVALID; D - DYNAMIC; G - GLOBAL, L - LINK-LOCAL
Columns: ADDRESS, FROM-POOL, INTERFACE, VRF, ADVERTISE, VALID, PREFERRED
 #     ADDRESS                       FROM-POOL        INTERFACE       VRF   ADVERTISE  VALID      PREFERRED
;;; PvtLAN IPv6 Address (WAN1)
 0   G XXXX:XXXX:XXXX:XXXX::4/64      ipv6_wan1_pool   vlan4-pvtlan    main  yes        23h25m12s  17h25m12s
;;; MGMT IPv6 Address (WAN1)
 1   G XXXX:XXXX:XXXX:XXXX::99/64     ipv6_wan1_pool   ether1          main  yes        23h25m12s  17h25m12s
;;; address pool error: pool not found: ipv6_wan2_pool (4)
;;; PvtLAN IPv6 Address (WAN2)
 2 I G ::204/64                      ipv6_wan2_pool   vlan4-pvtlan    main  yes                            
                                                                                                           
;;; address pool error: pool not found: ipv6_wan2_pool (4)
;;; MGMT IPv6 Address (WAN2)
 3 I G ::299/64                      ipv6_wan2_pool   ether1          main  yes                            
                                                                                                           
;;; address pool error: pool not found: ipv6_wan2_pool (4)
;;; IoTLAN IPv6 Address (WAN2)
 4 I G ::212/64                      ipv6_wan2_pool   vlan16-iotlan   main  yes                            
                                                                                                           
;;; IoTLAN IPv6 Address (WAN1)
 5   G XXXX:XXXX:XXXX:XXXX::12/64     ipv6_wan1_pool   vlan16-iotlan   main  yes        23h25m12s  17h25m12s
;;; PvtLAN ULA
 6   G fd04::1/128                 ula-pool1-pvt    vlan4-pvtlan    main  no                             
;;; GuestLAN ULA
 7 X G ::1/128                 ula-pool2-guest  vlan8-guestlan  main  no                             
;;; VPNLAN ULA
 8   G fd12::1/128                 ula-pool3-vpn    vlan12-vpnlan   main  no                             
;;; IoTLAN ULA
 9   G fd16::1/128                 ula-pool4-iot    vlan16-iotlan   main  no                             
;;; MGMT ULA
10   G fd99::1/128                 ula-pool5-mgmt   ether1          main  no                             
11  DL fe80::f91d:e50b:ff9d:3cbc/64                   wg1-protonvpn   main  no                             
12  DL fe80::73ae:8a22:b34d:ecf0/64                   wg2-protonvpn   main  no                             
13  DL fe80::b266:4f52:846f:fe80/64                   wg3-protonvpn   main  no                             
14  D  ::1/128                                        lo              main  no                             
15  DL fe80::f61e:57ff:fe34:f3ee/64                   vlan4-pvtlan    main  no                             
16  DL fe80::f61e:57ff:fe34:f3ee/64                   bridge1         main  no                             
17  DL fe80::f61e:57ff:fe34:f3ee/64                   vlan12-vpnlan   main  no                             
18  DL fe80::f61e:57ff:fe34:f3ee/64                   vlan8-guestlan  main  no                             
19  DL fe80::f61e:57ff:fe34:f3ee/64                   vlan16-iotlan   main  no                             
20  DL fe80::f61e:57ff:fe34:f3ef/64                   sfp-sfpplus1    main  no                             
21  DG XXXX:XXXX:XXXX:XXXX::1/128                     sfp-sfpplus1    main  no

IPv6 ND:

/ipv6/nd/print
Flags: X - disabled, I - invalid; * - default 
 0 X* interface=all ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=30m retransmit-interval=unspecified ra-lifetime=30m 
      ra-preference=medium hop-limit=unspecified advertise-mac-address=yes advertise-dns=yes managed-address-configuration=yes 
      other-configuration=no 

 1    interface=ether1 ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=30m retransmit-interval=unspecified ra-lifetime=30m 
      ra-preference=medium hop-limit=64 advertise-mac-address=yes advertise-dns=yes managed-address-configuration=yes 
      other-configuration=yes dns=fd99::1 

 2    interface=vlan4-pvtlan ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=30m retransmit-interval=unspecified 
      ra-lifetime=30m ra-preference=medium hop-limit=64 advertise-mac-address=yes advertise-dns=yes managed-address-configuration=yes 
      other-configuration=yes dns=fd04::1 

 3 X  interface=vlan8-guestlan ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=30m retransmit-interval=unspecified 
      ra-lifetime=30m ra-preference=medium hop-limit=64 advertise-mac-address=yes advertise-dns=no managed-address-configuration=yes 
      other-configuration=yes dns=fd08::1 

 4    interface=vlan16-iotlan ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=30m retransmit-interval=unspecified 
      ra-lifetime=30m ra-preference=medium hop-limit=64 advertise-mac-address=yes advertise-dns=yes managed-address-configuration=yes 
      other-configuration=yes dns=fd16::1 

 5    interface=vlan12-vpnlan ra-interval=3m20s-10m ra-delay=3s mtu=unspecified reachable-time=30m retransmit-interval=unspecified 
      ra-lifetime=30m ra-preference=medium hop-limit=64 advertise-mac-address=yes advertise-dns=yes managed-address-configuration=yes 
      other-configuration=yes dns=fd12::1

See also attached screenshot of Winbox for PvtLAN ND setup for your reference.

Screenshot From 2026-01-24 11-26-21
Screenshot From 2026-01-24 11-26-211579×1226 156 KB

IPv6 POOL:

/ipv6/pool/print
Flags: D - DYNAMIC
Columns: NAME, PREFIX, PREFIX-LENGTH, VALID-LIFETIME
#   NAME             PREFIX                   PREFIX-LENGTH  VALID-LIFETIME
0   ula-pool1-pvt    fd04::/64                          128                
1   ula-pool2-guest  fd08::/64                          128                
2   ula-pool3-vpn    fd12::/64                          128                
3   ula-pool4-iot    fd16::/64                          128                
4   ula-pool5-mgmt   fd99::/64                          128                
5 D ipv6_wan1_pool   XXXX:XXXX:XXXX:XXXX::/56             64  23h47m35s

IPv6 DHCP-SERVER:

/ipv6/dhcp-server/print
Flags: X - DISABLED, I - INVALID
Columns: NAME, INTERFACE, ADDRESS-POOL, PREFIX-POOL, PREFERENCE, LEASE-TIME
#   NAME               INTERFACE       ADDRESS-POOL     PREFIX-POOL  PREFERENCE  LEASE-TIME
;;; PvtLAN IPv6 Server
0   ula-server1-pvt    vlan4-pvtlan    ula-pool1-pvt    none         255  1d        
;;; VPNLAN IPv6 Server
1   ula-server3-vpn    vlan12-vpnlan   ula-pool3-vpn    none         255  1d        
;;; GuestLAN IPv6 Server
2 X ula-server2-guest  vlan8-guestlan  ula-pool2-guest  noney         255  1d        
;;; IoTLAN IPv6 Server
3   ula-server4-iot    vlan16-iotlan   ula-pool4-iot    none         255  1d        
;;; MGMT IPv6 Server
4 I ula-server5-mgmt   ether1          ula-pool5-mgmt   none         255  1d        

/ipv6/dhcp-server/option/print
Columns: NAME, CODE, VALUE
#  NAME                      CODE  VALUE                                                                             
;;; PvtLAN Option 23
0  ula-dns-opt23-1-pvt         23  0xfd040000000000000000000000000001                                                
;;; GuestLAN Option 23
1  ula-dns-opt23-2-guest       23  0xfd080000000000000000000000000001                                                
;;; VPNLAN Option 23
2  ula-dns-opt23-3-VPN         23  0xfd120000000000000000000000000001                                                
;;; Option 24 Domain List] [PvtLAN]
3  ula-domain-opt24-1-pvt      24  0x06'pvtlan'0x03'lan'0x0006'pvtlan'0x03'net'0x0006'pvtlan'0x05'local'0x00         
;;; IoTLAN Option 23
4  ula-dns-opt23-4-iot         23  0xfd160000000000000000000000000001                                                
;;; MGMT Option 23
5  ula-dns-opt23-5-mgmt        23  0xfd990000000000000000000000000001                                                
;;; Option 24 Domain List] [GuestLAN]
6  ula-domain-opt24-2-guest    24  0x09'guestwifi'0x03'lan'0x0009'guestwifi'0x03'net'0x0009'guestwifi'0x05'local'0x00
;;; Option 24 Domain List] [VPNLAN]
7  ula-domain-opt24-3-vpn      24  0x06'vpnlan'0x03'lan'0x0006'vpnlan'0x03'net'0x0006'vpnlan'0x05'local'0x00         
;;; Option 24 Domain List] [IoTLAN]
8  ula-domain-opt24-4-iot      24  0x06'iotlan'0x03'lan'0x0006'iotlan'0x03'net'0x0006'iotlan'0x05'local'0x00         
;;; Option 24 Domain List] [MGMT]
9  ula-domain-opt24-5-mgmt     24  0x04'mgmt'0x03'lan'0x0004'mgmt'0x03'net'0x0004'mgmt'0x05'local'0x00               

/ipv6/dhcp-server/option/sets/print
Columns: NAME, OPTIONS
#  NAME                OPTIONS                 
0  option-set-1-pvt    ula-domain-opt24-1-pvt  
1  option-set-2-guest  ula-domain-opt24-2-guest
2  option-set-3-vpn    ula-domain-opt24-3-vpn  
3  option-set-4-iot    ula-domain-opt24-4-iot  
4  option-set-5-mgmt   ula-domain-opt24-5-mgmt

IPv6 DHCP-CLIENT:

/ipv6/dhcp-client/print      
Flags: I - INVALID
Columns: INTERFACE, STATUS, REQUEST, PREFIX, ADDRESS
#   INTERFACE     STATUS   REQUEST  PREFIX                              ADDRESS                          
;;; WAN1 [MAIN]
0   sfp-sfpplus1  bound    address  XXXX:XXXX:XXXX:XXXX::/56, 23h45m40s  XXXX:XXXX:XXXX:XXXX::1, 23h45m40s
                           prefix                                                                        
;;; WAN2 [FAIL-OVER]
1 I sfp-sfpplus2  stopped  address                                                                       
                           prefix

DNS SETTINGS:

/ip dns print
                      servers:                                                   
              dynamic-servers:                                                   
               use-doh-server: https://dns.nextdns.io/xxxxxx/Z-CCR2004-GWRouter
              verify-doh-cert: yes                                               
   doh-max-server-connections: 50                                                
   doh-max-concurrent-queries: 500                                               
                  doh-timeout: 10s                                               
        allow-remote-requests: yes                                               
          max-udp-packet-size: 4096                                              
         query-server-timeout: 5s                                                
          query-total-timeout: 10s                                               
       max-concurrent-queries: 1000                                              
  max-concurrent-tcp-sessions: 500                                               
                   cache-size: 102400KiB                                         
                cache-max-ttl: 3d                                                
      address-list-extra-time: 0s                                                
                          vrf: main                                              
           mdns-repeat-ifaces: vlan4-pvtlan                                      
                               vlan12-vpnlan                                     
                               ether1                                            
                   cache-used: 39402KiB                                          

/ip dns static print
Flags: D - DYNAMIC
Columns: NAME, REGEXP, TYPE, ADDRESS, TTL
  #   NAME                         REGEXP                         TYPE  ADDRESS                     TTL
  0   dns.nextdns.io                                              AAAA  2a07:a8c0::                 1d 
  1   dns.nextdns.io                                              AAAA  2a07:a8c1::                 1d 
  2   dns.nextdns.io                                              A     45.90.28.0                  1d 
  3   dns.nextdns.io                                              A     45.90.30.0                  1d 
  4   PvtLAN.lan                                                  A     192.168.4.1                 1d 
  5   PvtLAN.net                                                  A     192.168.4.1                 1d 
  6   PvtLAN.local                                                A     192.168.4.1                 1d 
  7   PvtLAN.lan                                                  AAAA  fd04::1                     1d 
  8   PvtLAN.net                                                  AAAA  fd04::1                     1d 
  9   PvtLAN.local                                                AAAA  fd04::1                     1d 
 10   GuestWiFi.lan                                               A     192.168.8.1                 1d 
 11   GuestWiFi.local                                             A     192.168.8.1                 1d 
 12   GuestWiFi.lan                                               AAAA  fd08::1                     1d 
 13   GuestWiFi.local                                             AAAA  fd08::1                     1d 
 14   VPNLAN.lan                                                  A     192.168.12.1                1d 
 15   VPNLAN.net                                                  A     192.168.12.1                1d 
 16   VPNLAN.local                                                A     192.168.12.1                1d 
 17   VPNLAN.lan                                                  AAAA  fd12::1                     1d 
 18   VPNLAN.net                                                  AAAA  fd12::1                     1d 
 19   VPNLAN.local                                                AAAA  fd12::1                     1d 
 20   IoTLAN.net                                                  A     192.168.16.1                1d 
 21   IoTLAN.lan                                                  A     192.168.16.1                1d 
 22   IoTLAN.local                                                A     192.168.16.1                1d 
 23   IoTLAN.net                                                  AAAA  fd16::1                     1d 
 24   IoTLAN.lan                                                  AAAA  fd16::1                     1d 
 25   IoTLAN.local                                                AAAA  fd16::1                     1d 
 26   MGMT.net                                                    A     192.168.99.1                1d 
 27   MGMT.lan                                                    A     192.168.99.1                1d 
 28   MGMT.local                                                  A     192.168.99.1                1d 
 29   MGMT.net                                                    AAAA  fd99::1                     1d 
 30   MGMT.lan                                                    AAAA  fd99::1                     1d 
 31   MGMT.local                                                  AAAA  fd99::1                     1d 
.....
.....
;;; PvtLAN (iPv4)
 92                                .*\\.pvtlan\\.(lan|net|local)  A     192.168.4.1                 1d 
;;; PvtLAN (iPv6)
 93                                .*\\.pvtlan\\.(lan|net|local)  AAAA  fd04::1                     1d 
;;; GuestLAN (iPv4)
 94                                .*\\.guestwifi\\.(lan|local)   A     192.168.8.1                 1d 
;;; GuestLAN (iPv6)
 95                                .*\\.guestwifi\\.(lan|local)   AAAA  fd08::1                     1d 
;;; VPN-LAN (iPv4)
 96                                .*\\.vpnlan\\.(lan|net|local)  A     192.168.12.1                1d 
;;; VPN-LAN (iPv6)
 97                                .*\\.vpnlan\\.(lan|net|local)  AAAA  fd12::1                     1d 
;;; IoTLAN (iPv4)
 98                                .*\\.iotlan\\.(lan|net|local)  A     192.168.16.1                1d 
;;; IoTLAN (iPv6)
 99                                .*\\.iotlan\\.(lan|net|local)  AAAA  fd16::1                     1d 
;;; MGMT (iPv4)
100                                .*\\.mgmt\\.(lan|net|local)    A     192.168.99.1                1d 
;;; MGMT (iPv6)
101                                .*\\.mgmt\\.(lan|net|local)    AAAA  fd99::1                     1d 
102 D GuestWiFi.net                                               A     192.168.8.1                 5m

NOTE: I have disabled ipv6 related stuff above such as dhcp-pool, nd, dhcp-server, addresses etc. on the vlan8-guestlan. I observed that enabling these negatively impacts the working of hotspot (captive portal) server.

CHECKS ON Arch Linux:

$ resolvectl status
Global
           Protocols: LLMNR=resolve -mDNS DNSOverTLS=opportunistic DNSSEC=allow-downgrade/unsupported
    resolv.conf mode: stub
  Current DNS Server: 45.90.28.0#YYYYYY.dns.nextdns.io
         DNS Servers: 2a07:a8c0::#YYYYYY.dns.nextdns.io 2a07:a8c1::#YYYYYY.dns.nextdns.io 45.90.28.0#YYYYYY.dns.nextdns.io
                      45.90.30.0#YYYYYY.dns.nextdns.io
Fallback DNS Servers: 9.9.9.9#dns.quad9.net 149.112.112.112#dns.quad9.net 2620:fe::9#dns.quad9.net 2620:fe::fe#dns.quad9.net
                      1.1.1.1#cloudflare-dns.com 1.0.0.1#cloudflare-dns.com 2606:4700:4700::1111#cloudflare-dns.com
                      2606:4700:4700::1001#cloudflare-dns.com 8.8.8.8#dns.google 8.8.4.4#dns.google 2001:4860:4860::8888#dns.google
                      2001:4860:4860::8844#dns.google
          DNS Domain: ~.
.....
.....
.....
.....
Link 5 (wlan0)
    Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
         Protocols: +DefaultRoute LLMNR=resolve -mDNS DNSOverTLS=opportunistic DNSSEC=allow-downgrade/unsupported
Current DNS Server: 192.168.4.1
       DNS Servers: 192.168.4.1 fd04::1
        DNS Domain: ~. pvtlan.lan pvtlan.net pvtlan.local
     Default Route: yes

$ resolvectl query pvtlan.net
pvtlan.net: 192.168.4.1                        -- link: wlan0
            fd04::1                            -- link: wlan0

-- Information acquired via protocol DNS in 16.8ms.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: network

$ resolvectl query google.com                  
google.com: 142.250.191.206                    -- link: wlan0
            2607:f8b0:4009:81a::200e           -- link: wlan0

-- Information acquired via protocol DNS in 7.3ms.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: network

$ nslookup pvtlan.net  
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	pvtlan.net
Address: 192.168.4.1
Name:	pvtlan.net
Address: fd04::1

$ nslookup google.com    
Server:		127.0.0.53
Address:	127.0.0.53#53

Non-authoritative answer:
Name:	google.com
Address: 142.250.191.206
Name:	google.com
Address: 2607:f8b0:4009:81a::200e

$ ifconfig -a
.....
.....
.....
wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.7.117  netmask 255.255.252.0  broadcast 192.168.7.255
        inet6 fe80::cccc:cccc:cccc:cccc  prefixlen 64  scopeid 0x20<link>
        inet6 fd04::5  prefixlen 128  scopeid 0x0<global>
        inet6 XXXX:XXXX:XXXX:XXXX:ZZZZ:ZZZZ:ZZZZ:c310  prefixlen 64  scopeid 0x0<global>
        inet6 XXXX:XXXX:XXXX:XXXX:ZZZZ:ZZZZ:ZZZZ:fde5  prefixlen 64  scopeid 0x0<global>
        inet6 XXXX:XXXX:XXXX:XXXX:ZZZZ:ZZZZ:ZZZZ:6769  prefixlen 64  scopeid 0x0<global>
        ether MM:MM:MM:MM:MM:MM  txqueuelen 1000  (Ethernet)
        RX packets 228097  bytes 259135040 (247.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 85811  bytes 24432055 (23.3 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

Love to see your feedback and try-out. Also, would appreciate critiques / comments on my setup, if any.

Thanks and good luck!