As said in the title, I'm chosing what to do with my DNS server.
I have a custom DNS server in a VLAN and was struggeling to choose between these two options:
What would be the usecase/scenario of those options?
Hi,
it's kind of sparkling/still water dillema.
What is missing in router's DNS implementation you want from DNS? If nothing, then stay with ROS version.
If you need more, then use your additional one.
It depends on your DNS server, but I for instance have some custom rules that apply to specific VLANs. 1 allows you to do this (since your DNS server receives the IP of the requester, it allows you to do the matches). That kind of matching is currently impossible for Mikrotik DNS server.
You can also do dst-nat to have the same behaviour (your DNS server is the one replying queries) but the IP address you set to your devices is the Mikrotik’s one. However, you need to have the DNS server in its own VLAN for that to work.
The dst-nat thing also allows you to force all clients to go to your desired DNS server (assuming they are using plain and standard DNS) as well and not skip your desire altogether (like some Google TV does by going to Google servers).
I’ve got several VLANs on my network and depending upon their purpose, they have different DNS servers.
The guest/iot VLANs go straight out to 1.1.1.1 as I don’t want them accessing any of my internal resources anyway.
The ‘internal’ VLANs are set to use the MikroTik as the DNS resolver, which itself then resolves from an AdguardHome container. I use one of those scripts to add static entries for all DHCP clients e.g. printer, nas etc and so everything in these VLANs can access these internal resources but also benefit from the adblocking.
So in your scenario I’m preferring #2 because of the static entries that can be added by the router itself.
So it's seems that we have "case closed" 
If not clear, I was considering using a custom DNS server in both cases but with the following flow:
@Faceplate5158 can you expand more on that?
I use one of those scripts to add static entries for all DHCP clients e.g. printer, nas etc and so everything in these VLANs can access these internal resources but also benefit from the adblocking.
From memory it was this one: routeros-scripts/dhcp-to-dns.rsc at main · eworm-de/routeros-scripts · GitHub
As soon as a DHCP lease is given out, a static DNS entry is added. The servers i.e. printer/nas have their own static DHCP assignments, but the script takes care of adding the DNS entry.
I also have some Chromecast audios on their own VLAN which require using the mDNS repeater and some firewall rules to get working across VLANs.
For me at least, the mikrotik DNS server is good enough: mDNS, static entries, caching etc. Adlist I found to be a bit limited: it fails to block CNAME resolution so ads were getting through hence the use of Adguard as the upstream.
As simple as pig's tail
Put the firewall rules that catch DNS (port 53) traffic and conditionally pass requests for (1.) group directly to proper DNS server.
No need for scripts.You can use packet marks, connection marks, SRC MACs, in-interface, address lists to classify the traffic to be catch by particular fireall's rules. VLANs could be "catched" on brodges' level with proper rules.
So many options that I feel already lost
Your question boils down to: should I run my DNS server on a router or should I forward clients to the another one?
If remote server is far or slow, run one on the router: it will act as a caching server to speed up lookups (be sure not to open your DNS to the public Internet!)
If remote server is fast, do not run DNS on your router: The less services you run, the less resources wasted, attack surface is also smaller.
Does your DNS have a static IP you can give to your clients?
If yes, you do not need a DNS on your router.
It no, it seems that you do not have a choice.
Off-topic, but which are the firewall rules that you use for mDNS?
I currently have only this one (and I don’t remember where I got it):
chain=input action=accept protocol=udp dst-address=224.0.0.251 src-port=5353 dst-port=5353
As said earlier, I plan to have a custom DNS server anyway for better control and monitoring.
I was just wondering what was the better way to go:
Pointing the clients directly to my custom DNS address (and have a firewall rule that allows packets from all VLANS to the DNS server)
Pointing the clients to the router (avoiding the firewall rule) and then use the MikroTik DNS with my custom DNS server as upstream (if I understood correctly, this could let me have automatic dns names for my network devices, using a ROS script)
As figured out thanks to @BartoszP, I could point the clients to the router but instead of actually having 2 dns servers (mikrotik → custom), I could catch all the DNS requests and forward them to my DNS server (and this would also give me the benefit of preventing DNS override from the single devices)
Remeber that nowadays many programs do DNS queries inside the encrypted traffic so if only they get out of "your cage" then you have no control.
Yes same, plus one more. I believe this was my source for firewall rules: mDNS VLAN Setup Help - #4 by BillyBlaze
I'd only configure clients (e.g. via DHCP) to use MT as their DNS resolver (which in turn uses your more advanced DNS server as its upstream server) if I'd expect for ROS to do some decent caching of responses. And I've got an impression that DNS server in ROS can't do even that without occasional bugs (not to mention more serious problems when trying to use it as authoritative server for a domain).
So ... personally I'd just skip ROS (as L7 device) when engineering path of DNS queries.
A little while ago I asked myself the same question. In the end it came down to this for me:
So it depends on your needs.