Well i did system reset-config and did just a basic setup from scratch, and still DNS server is not replaying to outside clients…
I tried with different mikrotik, from company that i work for, and it works easy as hell…
I tried with 3 different RouterOS at my router and it still doesnt work…im runnin out of ideas 
Many users of this forum can supply you with many ideas. But you stubbornly ignore suggestion by @sindy to post full configuration export (obfuscated sensitive data such as public IP address, username and password) and it is really hard to point out think of all possible configuration mistakes that can be made.
Here is the code, but there is like nothing…i do have some dynamic routes tho, dont know why that didnt dispay in the export command…
BTW, i did everything on fresh new clean RouterOS without any configuration (except that DNS settings, static DNS record, and DHCP client so i can get internet access)…and without any configuration he couldnt replay the DNS record outside…
EDIT: i just want to say guys i appreciate so much that u are involved in my problem, cuz im learning a lot in this way…tnx to u guys
/interface ethernet
set [ find default-name=ether1 ] name=ether1-Wan
set [ find default-name=ether2 ] name=ether2-Wireless
set [ find default-name=ether3 ] name=ether3-Jason
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=3des
/ip pool
add name=dhcp_pool0 ranges=192.168.84.2-192.168.84.254
add name=dhcp_pool1 ranges=192.168.84.2-192.168.84.254
/ip dhcp-server
add address-pool=dhcp_pool1 disabled=no interface=ether2-Wireless lease-time=1h name=dhcp1
/ppp profile
set *0 only-one=yes
/queue simple
add disabled=yes max-limit=1M/10M name=Wireless target=192.168.84.0/24
/system logging action
set 0 memory-lines=100
set 1 disk-lines-per-file=100
/interface pptp-server server
set default-profile=default enabled=yes
/ip address
add address=192.168.84.1/24 interface=ether2-Wireless network=192.168.84.0
add address=10.0.0.1/24 interface=ether3-Jason network=10.0.0.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add dhcp-options=hostname,clientid disabled=no interface=ether1-Wan use-peer-dns=no
/ip dhcp-server network
add address=192.168.84.0/24 dns-server=8.8.8.8,8.8.4.4 gateway=192.168.84.1
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip firewall nat
add action=masquerade chain=srcnat comment="nat for eth3" out-interface=ether1-Wa
src-address=10.0.0.0/8
add action=masquerade chain=srcnat comment="nat for eth2" out-interface=ether1-Wa
src-address=192.168.84.0/24
add action=dst-nat chain=dstnat comment="web server" disabled=yes dst-port=80 protocol=tcp to-addr
10.0.0.10 to-ports=80
/ip route
add distance=1 dst-address=192.168.1.0/24 gateway=192.168.84.253
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Belgrade
/system identity
set name="Mikrotik"
Dynamic entries don’t get into export, you can only see those using print command.
Is there anything weird if you issue command “/ip firewall filter print”?
export only shows the static configuration elements, to see the dynamically created ones, you need to use print, and you can only print a single configuration tree leaf at a time. So post also /ip route print, and in order that it would make sense, you’ll have to obfuscate only the gateway IPs; the route dst-address must remain verbatim, and you’ll have to publish the address of the client from which you test.
Nothing… just this from the code
0 X ;;; accept DNS UDP
chain=input action=accept protocol=udp port=53 log=no log-prefix=""
1 X chain=input action=accept protocol=tcp port=53 log=no log-prefix=""
2 chain=output action=accept protocol=udp out-interface=ether1-Wan port=53 log=no log-prefix=""
u mean the public ip from dns client ? here is the ip route:
# DST-ADDRESS PREF-SRC GATEWAY DISTANCE
0 ADS 0.0.0.0/0 xx.xxx.xxx.x 1
1 ADC 10.0.0.0/24 10.0.0.1 ether3-Jason 0
2 ADC xx.xxx.xxx.0/21 xx.xxx.xxx.xxx ether1-Wan 0
3 A S 192.168.1.0/24 192.168.84.253 1
4 ADC 192.168.84.0/24 192.168.84.1 ether2-Wireless 0
Another idea for using torch: when you observe incoming DNS request at your WAN port, do you see a DNS request originating RB device being targeted at either of DNS forwarders (8.8.8.8 or 8.8.4.4)? Do you see reply coming from those?
Unless reply to your own DNS request is cached at router’s DNS service, you should be able to see that IP packet exchange.
yes i can see all the replays…i can see src 8.8.8.8 and dest 8.8.8.8 from the RB…everything is so clear…when remote client asks RB to resolve some dns record, router performs excellent, he resolves anything (from 8.8.8.8 ), put it even in a cache, but when it comes to forward that packet with src=public WAN, dst=remote client, that packet just doesnt happen, at least not in a torch, and in ipconfig /displaydns on remote dns client
The funny thing is that im trying to reslove dns query from 3 different ISPs from my country…and the situation is similar…i have RB433, with RouterOS 6.42.6 (i tried with 3 different version, the basic one, the 6.40.8, and this one - the newest)…called 2 times my ISP to ask them if they are blocking dns replays from their clients and two times the answer was no…so i have some feeling that is some generic problem, hardware, or something like that 
Perhaps unrelated: you have configured static route towards network 192.168.1.0/24 using gateway with address 192.168.85.253. That IP address is member of DHCP address pool you’re using. Either the gateway is really using DHCP-assigned address which means it can change in time (I don’t see static assignment in your export) and the static route would fail … or you’ve statically set up device’s address but in this case you’d better choose address outside DHCP address pool to avoid potential address collision.
Can you kindly show (at least one of) IP address of a DNS client so we can (mentally) verify your routing set-up.
Here is one of my remote IPs, im using HSPA+ hotspot of mobile, so i connected laptop to it…the ip is 77.243.29.179 …
Btw, its not about the routes, because i tried with blank system conf reset RB, without any more config, and the problem was the same:
It’s possible to miss things in torch, you can use logging rules instead:
/ip firewall mangle
add action=log chain=output log-prefix="step1" protocol=udp src-port=53
add action=log chain=postrouting log-prefix="step2" protocol=udp src-port=53
And btw:
My RouterOS answers tcp queries just fine.
What postrouting means ? cuz on mangle windows there are some packets flowing around at that step 2
It’s after packet was routed somewhere. And it will show some you don’t need to see, so try to add src-address-type=local as basic filter. In any case, when you send request from outside, you should see both steps logged for response.
when i do nslookup google.com on remote DNS client both mangles gets their packets incremented…
im hitting the limit of my network knowledge here i guess…
They should also be logged with some details, so check if packets are going the right way, i.e. via WAN interface to client’s IP address. If they do, then router is sending replies back to client correctly. And if they don’t arrive, then something must eat them somewhere between you and client. But it’s not easy to diagnose it when the path is not under your control.
/log print where topics~“firewall”
Can u explain me more what should i do exactly to track that and be sure that packet went out of my WAN int ? Im kinda confuse
The command doesnt display me anything
That sounds like logging was completely off for firewall events or other events arrive with such a pace that they kick off the older events (including those from firewall) before you issue the command. So you can run /log print follow-only where topics~“firewall” while testing the DNS to see whether the events are logged or not.