Using remote DNS for specific subdomains

RouterOS General
1

Here’s my setup:

  1. I have 2 sites: HOME with 10.0.0.1/24 and REMOTE with 10.10.10.1/24
  2. There’s a wireguard server on REMOTE and a wireguard peer on HOME, which gets 10.10.11.69
  3. There is proper routing configured from 10.0.0.0 to 10.10.10.0 via 10.10.11.69
  4. HOME is doing NAT for outbound connections to REMOTE, so from their perspective every host in HOME is visible as 10.10.11.69

This setup works correctly, I can reach the REMOTE hosts via their IP addresses, both from HOME router and from HOME LAN devices.

Now - the REMOTE mikrotik has static DNS entries configured, e.g. example.remote.dev A 10.10.10.2. I can resolve this from my HOME LAN via nslookup example.remote.dev 10.10.10.1 and is resolves correctly.

I would like to somehow achieve a conditional DNS resolution, i.e. if a client on my HOME network asks my HOME router for any subdomain of *.remote.dev, I would like the HOME router to use the REMOTE router (10.10.10.1) for resolution.

I’ve successfully achieved this in Adguard, by simply adding [/remote.dev/]10.10.10.1 as an upstream DNS, but I want this to happen on HOME mikrotik as this is the source-of-truth for all DNS resolution for my LAN.

I’m wondering - is there maybe some smart firewall NATting I could do, using the content field to achieve this? (or layer7?)

I imagine a scenario, in which HOME receives a UDP packet with DNS request with the content of “remote.dev” it would NAT the packet and send out to 10.10.10.1 for processing. Is something like this possible?

2

Create an FWD zone in the Mikrotik DNS

/ip dns static
add forward-to=172.22.10.1 regexp=“\.remote\.dev$” type=FW

where the ip is the ip of the other side.

3

Thank you, that works! But only if I disable DoH (as an upstream DNS! It makes no sense :/)