There are number of DNS technics that can hime my queries from ISP along the path: DNS Crypt, DNS over HTTPs, DNS over TLS etc. Please add support for any (or some) or these to ROS, due to fact this is more and more popular demand nowdays in too many countries.
You can definitely recall Russia and China government state-scale sites blacklist which push ISP to return fake reply for sites that are backlisted for political reasons.
I want to hide my activity to, so it would be great to make such functionality like DNS over HTTPs, DNS over TLS.
Another +1 for some form of encrypted DNS support out of the box.
This is quite topical with the recently announced DNS resolver partnership between Cloudflare and APNIC promoting its use: https://1.1.1.1/
Then hopefully your activity doesn’t include anything with http. Plain old http is fully readable, and https does protect content, but still leaks target hostname because of SNI.
One more request related to this one http://forum.mikrotik.com/t/feature-request-dnscrypt-support/53792/1
Hope we will get answer from dev or support team.
Any updates?
It may be in RouterOS 7 or not.
Because government’s are getting more and more curious, in what civilians are interested in on the Internet it is better to put also the DNS request into a Private Network together with the rest of your internet traffic.
Let’s hope that Mikrotik is going to develop better support in router, for OpenVPN and IKE2 as client.
And Wireguard which trounces both of them for security, throughput, and latency.
Looks very impressive and lets hope it will be adapted widely soon.
Yet this “impressive” VPN can not be used on Windows, so seems to be no use out there in the wild. So far Windows PCs are a huge part of user base, so not to support them is something risky.
There are some VPN technologies like Wireguard, tinc, some others, all are (seems to be) good, but no router should support all of them. Even SSTP looks an overkill. Let’s do few protocols but do them very good (not like semi-done ovpn now).
From their homepage:
WireGuard is not yet complete. > You should not rely on this code. > It has not undergone proper degrees of security auditing and the protocol is still subject to change. We’re working toward a stable 1.0 release, but that time has not yet come.
So one day it may become great and if it does, I hope to see it in RouterOS too. But until then, improvements for good old OpenVPN would be enough to make many people happy.
I just setup pi-hole in a vm.
Pi-hole connects to DNS via TLS.
DHCP hands out PiHole as dns server
DHCP hands out router as secondary dns server to handle local dns request based on static entries applied via dhcp handouts.
Agreed. Just something to be aware of, because by the time they get around to OpenVPN improvements, Wireguard may be mainstream … 
+1 for secure DNS feature.
+1 for secure DNS feature.
Support for
DNS over HTTPS, DNS over TLS