I had IPV6 running for some time using NextDNS, and I was using some of the nice adblocking features provided, but I really wanted to be using the IPV6 caching on the mikrotik router.
Attached is documentation and steps build while working with Claude.ai to synthesize the right set of commands for setting this up on your own:
MikroTik RouterOS 7.19.1 - IPv6 DNS Caching Configuration
Overview
This document describes how to configure a MikroTik router to act as an IPv6 DNS cache for LAN clients. By default, MikroTik's Neighbor Discovery (ND) advertises upstream DNS servers directly to clients, bypassing the router's DNS cache. This configuration changes that behavior so all IPv6 DNS queries go through the MikroTik's caching DNS server.
The Problem
When advertise-dns=yes is enabled in IPv6 ND, MikroTik advertises the IPv6 DNS servers configured in /ip dns directly to clients. This means:
-
IPv6 DNS queries bypass the router's cache
-
Queries go directly to upstream DNS servers
-
No local caching benefit for repeated queries
The Solution
-
Assign a stable ULA (Unique Local Address) to each LAN interface
-
Configure ND to advertise the router's ULA as the DNS server
-
The MikroTik caches queries and forwards cache misses to upstream servers
Network Topology
Hardware
-
Router: MikroTik RouterOS 7.19.1
-
WAN: AT&T Fiber via sfp-sfpplus1
-
LAN1: bridge-lan1 (primary LAN for PCs)
-
LAN2: bridge-lan2 (secondary LAN)
-
LAN3: bridge-lan3 (SFP+ configuration network)
IPv6 Addressing Summary
| Interface | Global IPv6 Prefix | ULA (DNS) | Purpose |
|---|---|---|---|
| sfp-sfpplus1 | 2001:506:73a6:f7a::1/128 | — | WAN uplink |
| bridge-lan1 | 2600:1700:3a61:6f0::/64 | fd00::1 | Primary LAN |
| bridge-lan2 | 2600:1700:3a61:6f1::/64 | fd00::2 | Secondary LAN |
| bridge-lan3 | — | — | Management only |
AT&T Prefix Delegation
AT&T provides a /60 prefix (2600:1700:3a61:6f0::/60), which yields 16 usable /64 subnets:
| Subnet ID | Network | Assignment |
|---|---|---|
| 0 | 2600:1700:3a61:6f0::/64 | bridge-lan1 |
| 1 | 2600:1700:3a61:6f1::/64 | bridge-lan2 |
| 2-f | 2600:1700:3a61:6f2::/64 - 6ff::/64 | Available |
DNS Server Configuration
Upstream DNS Servers (NextDNS)
This guide uses NextDNS as the upstream resolver. You can substitute any DNS provider (Cloudflare, Google, Quad9, etc.).
Note: NextDNS provides profile-specific IP addresses linked to your account. Log in to my.nextdns.io and navigate to your profile's Setup tab to find your assigned addresses.
| Protocol | Primary | Secondary |
|---|---|---|
| IPv4 | 45.90.28.x | 45.90.30.x |
| IPv6 | 2a07:a8c0::xx:xxxx | 2a07:a8c1::xx:xxxx |
Alternative DNS Providers:
| Provider | IPv4 | IPv6 |
|---|---|---|
| Cloudflare | 1.1.1.1, 1.0.0.1 | 2606:4700:4700::1111, 2606:4700:4700::1001 |
| 8.8.8.8, 8.8.4.4 | 2001:4860:4860::8888, 2001:4860:4860::8844 | |
| Quad9 | 9.9.9.9, 149.112.112.112 | 2620:fe::fe, 2620:fe::9 |
View Current DNS Configuration
/ip dns print
Sample output:
servers: <your-ipv4-dns-1>
<your-ipv4-dns-2>
<your-ipv6-dns-1>
<your-ipv6-dns-2>
dynamic-servers: 68.94.156.8
68.94.157.8
allow-remote-requests: yes
cache-size: 32768KiB
cache-used: 6194KiB
Configure DNS Servers
Replace the placeholder addresses with your own DNS servers:
/ip dns set servers=<your-ipv4-dns-1>,<your-ipv4-dns-2>,<your-ipv6-dns-1>,<your-ipv6-dns-2> allow-remote-requests=yes
Example using Cloudflare:
/ip dns set servers=1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001 allow-remote-requests=yes
Key setting: allow-remote-requests=yes allows the MikroTik to act as a DNS server for LAN clients.
IPv6 Address Configuration
View All IPv6 Addresses
/ipv6 address print
Sample output:
Flags: D - DYNAMIC; G - GLOBAL, L - LINK-LOCAL
# ADDRESS FROM-POOL INTERFACE ADVERTISE
0 G 2600:1700:3a61:6f0::fa82/64 att bridge-lan1 yes
4 DL fe80::7a9a:18ff:fe9a:2620/64 bridge-lan1 no
5 DL fe80::7a9a:18ff:fe9a:2623/64 bridge-lan2 no
7 G fd00::1/64 bridge-lan1 no
8 G 2600:1700:3a61:6f1::1/64 att bridge-lan2 yes
9 G fd00::2/64 bridge-lan2 no
Add ULA Address for DNS (bridge-lan1)
/ipv6 address add address=fd00::1/64 advertise=no interface=bridge-lan1
Parameters explained:
-
address=fd00::1/64— Unique Local Address for DNS service -
advertise=no— Don't advertise this prefix via SLAAC (clients won't get fd00:: addresses) -
interface=bridge-lan1— Assign to primary LAN bridge
Add Global + ULA Addresses (bridge-lan2)
/ipv6 address add address=2600:1700:3a61:6f1::1/64 interface=bridge-lan2 advertise=yes from-pool=att
/ipv6 address add address=fd00::2/64 advertise=no interface=bridge-lan2
Parameters explained:
-
from-pool=att— Use address from the AT&T delegated pool -
advertise=yes— Advertise this prefix so clients get global IPv6 addresses
Neighbor Discovery (ND) Configuration
View Current ND Configuration
/ipv6 nd print
/ipv6 nd print detail
Sample output:
Flags: X - disabled, I - invalid; * - default
0 * interface=all ... advertise-dns=no dns=""
1 interface=bridge-lan1 ... advertise-dns=yes dns=fd00::1
2 interface=bridge-lan2 ... advertise-dns=yes dns=fd00::2
Understanding ND Entries
| Flag | Meaning |
|---|---|
| * | Default entry |
| X | Disabled |
| I | Invalid |
The interface=all entry applies to all interfaces unless overridden by a specific interface entry.
Configure ND for bridge-lan1
If an entry for bridge-lan1 already exists but is disabled:
/ipv6 nd enable [find interface=bridge-lan1]
/ipv6 nd set [find interface=bridge-lan1] dns=fd00::1 advertise-dns=yes
If no entry exists, create one:
/ipv6 nd add interface=bridge-lan1 dns=fd00::1 advertise-dns=yes
Configure ND for bridge-lan2
/ipv6 nd add interface=bridge-lan2 dns=fd00::2 advertise-dns=yes
Disable DNS Advertisement on Default Entry
To prevent the interface=all entry from advertising upstream DNS:
/ipv6 nd set [find interface=all] advertise-dns=no
Or by index:
/ipv6 nd set 0 advertise-dns=no
Complete Configuration Commands
bridge-lan1 Setup
# Add ULA address for DNS
/ipv6 address add address=fd00::1/64 advertise=no interface=bridge-lan1
# Enable ND entry for bridge-lan1 (if disabled)
/ipv6 nd enable [find interface=bridge-lan1]
# Configure ND to advertise router as DNS
/ipv6 nd set [find interface=bridge-lan1] dns=fd00::1 advertise-dns=yes
# Disable DNS advertisement on default entry
/ipv6 nd set [find interface=all] advertise-dns=no
bridge-lan2 Setup
# Add global IPv6 address from AT&T pool
/ipv6 address add address=2600:1700:3a61:6f1::1/64 interface=bridge-lan2 advertise=yes from-pool=att
# Add ULA address for DNS
/ipv6 address add address=fd00::2/64 advertise=no interface=bridge-lan2
# Create ND entry for bridge-lan2
/ipv6 nd add interface=bridge-lan2 dns=fd00::2 advertise-dns=yes
Verification Commands
MikroTik Router
Check IPv6 Addresses
/ipv6 address print
Check ND Configuration
/ipv6 nd print detail
Check ND Prefixes
/ipv6 nd prefix print
Check DNS Settings
/ip dns print
View DNS Cache
/ip dns cache print
Flush DNS Cache
/ip dns cache flush
Count Cached Entries
/ip dns cache print count-only
Check Interface Lists
/interface list print
/interface list member print
Check Bridge Ports
/interface bridge port print
Check DHCPv6 Client (WAN)
/ipv6 dhcp-client print detail
Check DHCPv6 Server (LAN)
/ipv6 dhcp-server print
/ipv6 dhcp-server option print
Client Verification
macOS
Check DNS Servers in Use
scutil --dns
Look for your ULA (fd00::1 or fd00::2) in resolver #1.
Check IPv6 Address
ifconfig | grep "inet6 2600"
Test DNS Resolution via Router
dig @fd00::1 google.com
Test AAAA Record Lookup
dig -6 -t AAAA @fd00::1 google.com
Test IPv6 Connectivity
ping6 google.com
Flush DNS Cache (macOS)
sudo killall -HUP mDNSResponder
List Network Services
networksetup -listallhardwareports
Windows
Check DNS Servers
ipconfig /all
Flush DNS Cache
ipconfig /flushdns
Test DNS Resolution
nslookup google.com fd00::1
Linux
Check DNS Configuration
cat /etc/resolv.conf
or
resolvectl status
Test DNS Resolution
dig @fd00::1 google.com
Check IPv6 Address
ip -6 addr show
Troubleshooting
Client Not Receiving fd00::1 as DNS
-
Check ND configuration:
/ipv6 nd print detailVerify
dns=fd00::1andadvertise-dns=yesfor your interface. -
Check for disabled entry (X flag):
/ipv6 nd enable [find interface=bridge-lan1] -
Check default entry override: The
interface=allentry may be advertising different DNS. Disable its DNS:/ipv6 nd set [find interface=all] advertise-dns=no -
Renew client network:
-
Toggle network interface off/on
-
Or flush DNS and wait for new Router Advertisement
-
DNS Queries Not Being Cached
-
Verify allow-remote-requests:
/ip dns printMust show
allow-remote-requests: yes -
Check firewall rules:
/ipv6 firewall filter printEnsure UDP/TCP port 53 is allowed from LAN.
Client Gets Global DNS Instead of ULA
DHCPv6 may be overriding ND. Check:
/ipv6 dhcp-server option print
If DHCPv6 option 23 (DNS) is configured with external servers, either:
-
Remove the option, or
-
Change it to advertise the ULA address
No IPv6 Connectivity on LAN2
-
Check address assignment:
/ipv6 address print where interface=bridge-lan2Must have a global address with
advertise=yes. -
Check prefix advertisement:
/ipv6 nd prefix print where interface=bridge-lan2 -
Check pool availability:
/ipv6 pool print
Why ULA for DNS?
Using Unique Local Addresses (fd00::/8) for DNS service provides:
| Benefit | Explanation |
|---|---|
| Stability | ULA doesn't change when ISP prefix changes |
| Persistence | Works even during ISP outages (for cached entries) |
| Simplicity | Same address works regardless of ISP |
| No advertisement | Clients don't get SLAAC addresses from ULA prefix |
If AT&T changes your delegated prefix (e.g., after modem reboot), clients still reach the DNS cache at fd00::1 without reconfiguration.
Final Configuration Summary
ND Entries
| # | Interface | DNS | Advertise DNS | Status |
|---|---|---|---|---|
| 0 | all | — | no | Active (default) |
| 1 | bridge-lan1 | fd00::1 | yes | Active |
| 2 | bridge-lan2 | fd00::2 | yes | Active |
IPv6 Addresses
| Interface | Address | Type | Advertise | Purpose |
|---|---|---|---|---|
| bridge-lan1 | 2600:1700:3a61:6f0::fa82/64 | Global | yes | Client SLAAC |
| bridge-lan1 | fd00::1/64 | ULA | no | DNS service |
| bridge-lan2 | 2600:1700:3a61:6f1::1/64 | Global | yes | Client SLAAC |
| bridge-lan2 | fd00::2/64 | ULA | no | DNS service |
DNS Flow
┌─────────────┐ ┌─────────────────┐ ┌──────────────┐
│ LAN Client │────▶│ MikroTik Cache │────▶│ Upstream DNS │
│ (fd00::1) │ │ (fd00::1) │ │ (IPv4/IPv6) │
└─────────────┘ └─────────────────┘ └──────────────┘
│
▼
┌─────────────┐
│ Local Cache │
│ (0ms reply) │
└─────────────┘
Document Information
-
Router OS Version: 7.19.1
-
Date Created: December 2025
-
Upstream DNS: Any IPv4/IPv6 capable DNS provider (NextDNS, Cloudflare, Google, Quad9, etc.)
-
ISP: AT&T Fiber (configuration adaptable to other ISPs with DHCPv6-PD)
Do not use