Oops, my mistake.
Added \x03 to regexp.
Thanks!
As I understood from comment
http://forum.mikrotik.com/t/need-help-with-using-an-internal-dns/118956/1
MikroTik ignores all null bytes in any packets, so when I write l7 filter regexp for any type of data, I should just skip any sequence of 00’s.
If it’s wrong, please correct me.
0000 04 74 65 73 74 03 6c 61 6e 00 00 01 00 01 .test.lan.....
^ ^ ^
"lan" lenght Null bytes, ignored by ROS
Anyway, the issue has been resolved. Thank you!