unable to load specific sites / DNS Resolution problem [SOLVED]

RouterOS General
1

Hi, I just finish configuring my new RB95Ui, I have a PPoP connection, I set all firewall, NAT rules, and everything works fine, all the stations can browse, but there are some sites that will not load, if I load them with my phone they do work, so I know is something with my DNS server, as an example I am trying to load https://www.slack.com, and it never loads, and it never return error message, this is what the log says

0:51:10 dns local query: #25171 www.slack.com. A 
jul/17 00:51:10 dns,packet --- sending udp query to 8.8.4.4:53: 
jul/17 00:51:10 dns,packet id:bea6 rd:1 tc:0 aa:0 qr:0 ra:0 QUERY 'no error' 
jul/17 00:51:10 dns,packet question: www.slack.com:A:IN 
jul/17 00:51:10 firewall,info dstnat: in:bridge1 out:(none), src-mac f8:b1:56:a9:80:bd, proto TCP (SYN), 192.168.1.204:49939->52.2.207.185:80, len 52 
jul/17 00:51:10 dns,packet --- got answer from 8.8.4.4:53: 
jul/17 00:51:10 dns,packet id:bea6 rd:1 tc:0 aa:0 qr:1 ra:1 QUERY 'no error' 
jul/17 00:51:10 dns,packet question: www.slack.com:A:IN 
jul/17 00:51:10 dns,packet answer: 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=54.236.219.61> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=52.2.207.185> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=54.175.182.139> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=52.5.203.139> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=52.6.255.153> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=52.7.206.42> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=52.4.150.122> 
jul/17 00:51:10 dns,packet <www.slack.com:A:59=52.1.22.160> 
jul/17 00:51:10 dns done query: #25171 www.slack.com 54.236.219.61 
jul/17 00:51:10 web-proxy,account 192.168.1.204 GET http://www.slack.com/  action=allow cache=MISS 
jul/17 00:51:10 web-proxy,debug     GET / HTTP/1.1 
jul/17 00:51:10 web-proxy,debug     Accept: text/html, application/xhtml+xml, */* 
jul/17 00:51:10 web-proxy,debug     Accept-Language: en-US 
jul/17 00:51:10 web-proxy,debug     User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko 
jul/17 00:51:10 web-proxy,debug     Accept-Encoding: gzip, deflate 
jul/17 00:51:10 web-proxy,debug     Host: www.slack.com 
jul/17 00:51:10 web-proxy,debug     X-Proxy-ID: 648681164 
jul/17 00:51:10 web-proxy,debug     X-Forwarded-For: 192.168.1.204 
jul/17 00:51:10 web-proxy,debug     Via: 1.1 192.168.1.1 (Mikrotik HttpProxy) 
jul/17 00:51:10 web-proxy,debug 
jul/17 00:51:10 web-proxy,debug Response to "GET http://www.slack.com/": 
jul/17 00:51:10 web-proxy,debug     HTTP/1.1 302 Found 
jul/17 00:51:10 web-proxy,debug     Content-Encoding: gzip 
jul/17 00:51:10 web-proxy,debug     Content-Type: text/html 
jul/17 00:51:10 web-proxy,debug     Date: Thu, 16 Jul 2015 15:51:10 GMT 
jul/17 00:51:10 web-proxy,debug     location: https://www.slack.com/ 
jul/17 00:51:10 web-proxy,debug     Server: Apache 
jul/17 00:51:10 web-proxy,debug     Vary: Accept-Encoding 
jul/17 00:51:10 web-proxy,debug     X-Frame-Options: SAMEORIGIN 
jul/17 00:51:10 web-proxy,debug     Content-Length: 20 
jul/17 00:51:10 web-proxy,debug

then I get something like:

ul/17 00:55:07 dns,packet question: www.slack.com:A:IN 
jul/17 00:55:07 dns query from 192.168.1.204: #25238 www.slack.com. A 
jul/17[color=#FF0000] 00:55:07 dns done query: #25238 dns name exists, but no appropriate record [/color]
jul/17 00:55:07 dns,packet --- sending reply to 192.168.1.204:55091: 
jul/17 00:55:07 dns,packet id:563c rd:1 tc:0 aa:0 qr:1 ra:1 QUERY 'no error' 
jul/17 00:55:07 dns,packet question: www.slack.com:A:IN 
jul/17 00:55:07 dns,packet answer: 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=52.4.150.122> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=52.2.207.185> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=54.236.219.61> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=52.1.22.160> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=52.7.206.42> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=54.175.182.139> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=52.5.203.139> 
jul/17 00:55:07 dns,packet <www.slack.com:A:7=52.6.255.153>

this is my DNS sttings:

 print
                servers: 8.8.8.8,8.8.4.4,
                         4.2.2.1
        dynamic-servers: 61.207.11.153,
                         221.113.139.137
  allow-remote-requests: yes
    max-udp-packet-size: 4096
   query-server-timeout: 4s
    query-total-timeout: 10s
             cache-size: 8192KiB
          cache-max-ttl: 1h
             cache-used: 33KiB

Already tried this http://forum.mikrotik.com/t/dns-resolution-intermittent-issue-possible-solution/64103/1 but it didn’t work

Any help will be appreciated

2

Ok after many hours browsing and trying I found the problem it was due to TCP MSS packet size as some one in other forum suggested, basically the problem is that when you configure the pppoe to modify the TCP MSS it adds two rules to the mangle section at the firewall, but sometimes this rules are not correct, don’t know if this is a bug on Mikrotik or an error from the ISP, so you get a lot of fragmentation from the packages so for some sites when you browse the packages are sent and dropped, and sent and dropped in a loop until the time out error appears, the first step is to set up the pppoe profile->General->Change TCP MSS to default value. then on Mangle tab at Firewall Section create a new rule with:

[GENERAL TAB]
Chain: forward
Protocol: tcp
Out. Interface: your out interface (pppoe-out in my case)

[ADVANCE TAB]
TCP Flags: syn

[ACTION TAB]
Action: Change MSS
New TCP MSS: here is the catch, here you define the size of the package if its too high you will have DNS problems and fragmentation, if its too small you will have other problems, in my case setting it to 133 did the trick
Passthrough: checked.

At PPP section on the Interface for pppoe the Max MTU was set to 1480, Max MRU to 1400 and MRRU to 1400

hope this helps someone else.