I am new to Mikrotik so please forgive any ignorance.

I have a single forest, single domain environment where the domain controller was forwarding DNS lookups to our previous router to prevent the DC from going directly online. The router was also handling DNS cache for all interfaces.

I'd like to perform the same thing with the RB4011 we now have, but the articles/documentation I've read haven't offered clarity or seemingly mention that the remote requests is not recommended as though it's allowing outside sources to request lookups from the router.

Is this just a firewall rule? As of now, the DC can't resolve the IP of the router...

Would appreciate some direction/examples on how to get this working, or if there's a better approach.

Thanks in advance.