Does DoH reliably work on RouterOS?

Kentzo · Mon Apr 28, 2025 8:14 am

Every now and then I'd try the DoH (quad9) setting on RouterOS only to find it to be unreliable, just dropping DNS requests for one reason or another. Usually it results in my web browser being stuck loading webpages, likely waiting for some long timeout to trigger. Nowadays it does not seem to happen very often, but when it does it's extremely annoying. In the logs it usually looks like this:

2025-04-27 21:22:38 dns,error DoH server connection error: remote disconnected while in HTTP exchange
2025-04-27 21:44:12 dns,error DoH server connection error: Idle timeout - waiting data
2025-04-27 21:45:19 dns,error DoH server connection error: Idle timeout - waiting data
2025-04-27 21:45:19 dns,error DoH server connection error: Idle timeout - waiting data [ignoring repeated messages]

Are there happy users or do you guys just use a proper 3rd party DNS Proxy to reliably forward requests to DoH / DoT endpoints?

loloski · Mon Apr 28, 2025 8:16 am

since day 1 this DoH implementation in ROS v7 is shaky at best for the same reason you mentioned

Mon Apr 28, 2025 9:31 am

All other popular DoH services work with MikroTik without issue. You should not judge DoH implementation in MikroTik by just testing the one service that often does not respond. As far as we can say, the only complaints about DoH are with Quad9, not sure why.

loloski · Mon Apr 28, 2025 10:10 am

even cloudflare same thing i've seen this kind of behavior i'm not judging I'm just stating the facts since this is not mandatory so that's fine I just turned it off, I have 12 upstream in a single box I rotate each every ISP there's always a timeout one way or another.

infabo · Mon Apr 28, 2025 10:15 am

I don't know either, but I get these message as well. It is NextDNS.

04-26 15:19:45 dns,error DoH server connection error: remote disconnected while in HTTP exchange 
04-27 09:28:48 dns,error DoH server connection error: SSL: internal error (6) 
04-27 10:36:53 dns,error DoH server connection error: remote disconnected while in HTTP exchange 
04-27 14:06:16 dns,error DoH server connection error: remote disconnected while in HTTP exchange 
04-27 18:36:44 dns,error DoH server connection error: Idle timeout - connecting 
 04-27 18:48:20 dns,error DoH server connection error: remote disconnected while in HTTP exchange
 04-27 20:08:54 dns,error DoH server connection error: remote disconnected while in HTTP exchange
 04-27 20:30:23 dns,error DoH server connection error: remote disconnected while in HTTP exchange
 02:00:34 dns,error DoH server connection error: Idle timeout - waiting data
 02:00:34 dns,error DoH server connection error: Idle timeout - waiting data [ignoring repeated messages]
 02:00:40 dns,error DoH server connection error: SSL: internal error (6)
 02:00:40 dns,error DoH server connection error: SSL: internal error (6) [ignoring repeated messages]
 02:19:13 dns,error DoH server connection error: remote disconnected while in HTTP exchange

ToTheFull · Mon Apr 28, 2025 11:37 am

Every now and then I'd try the DoH (quad9) setting on RouterOS only to find it to be unreliable, just dropping DNS requests for one reason or another. Usually it results in my web browser being stuck loading webpages, likely waiting for some long timeout to trigger. Nowadays it does not seem to happen very often, but when it does it's extremely annoying. In the logs it usually looks like this:
Code: Select all
2025-04-27 21:22:38 dns,error DoH server connection error: remote disconnected while in HTTP exchange
2025-04-27 21:44:12 dns,error DoH server connection error: Idle timeout - waiting data
2025-04-27 21:45:19 dns,error DoH server connection error: Idle timeout - waiting data
2025-04-27 21:45:19 dns,error DoH server connection error: Idle timeout - waiting data [ignoring repeated messages]
Are there happy users or do you guys just use a proper 3rd party DNS Proxy to reliably forward requests to DoH / DoT endpoints?

I can only speak to 1.1.1.1/1.0.0.1 which works well, on the other hand Quad9 doesn't work as well. I even asked Quad9 but got no reply.
They asked me what server I was connected to and that was the last I heard. I gave up on it after a couple of weeks of waiting with poor dns.
That Was John Todd himself asking the question.
Pretty rubbish tbh, pretty much the same as Mikrotiks response above!

eworm · Mon Apr 28, 2025 12:35 pm

Usually Cloudflare works fine for me. I have Quad9 as a fallback (via script), but if that is actually used it causes hiccups every now and then.

To chime in here... Any chance we see DoQ (DNS over Quic) any time soon? Basically it is the same, but uses Quic (which in turn uses UDP) as transport - just like HTTP/3 does. That could help to mitigate some timeout issues and make the service more reliable I guess.

Amm0 · Mon Apr 28, 2025 11:47 pm

As a general matter, I don't like any kinda TCP for DNS, so not a big user of DoH as result. So +1 to DoQ as that give you secure DNS, without extra complexity TCP's 3-way handshakes + TLS.

Now Quad9 uses PowerDNS, which does not support DoQUIC [yet?]...so may not help for Quad9.

Kentzo · Tue Apr 29, 2025 12:26 am

The benefit of DoH is opaqueness at the expense of much higher complexity.

In absence of this requirement, do you think DoQ would perform better than DoT?

Amm0 · Tue Apr 29, 2025 12:35 am

In absence of this requirement, do you think DoQ would perform better than DoT?

Theoretically, yes. "Plain" UDP DNS is generally one packet request, one packet response - hard to get quicker than than. QUIC does auth and request at same time, so it avoids the whole TCP SYN/ACK dance, so unless implementation is bad, it be more efficient. Now since DoQ is relatively new, you could run into problem where various implementation details break things (like DoH to Quad9, which "should" just work, yet...).

Kentzo · Tue Apr 29, 2025 12:47 am

All other popular DoH services work with MikroTik without issue. You should not judge DoH implementation in MikroTik by just testing the one service that often does not respond. As far as we can say, the only complaints about DoH are with Quad9, not sure why.

I gave Cloudflare (https://cloudflare-dns.com/dns-query) a shot today. Same problem, same occurrence frequency:

14:25:49 echo: dns,error DoH server connection error: Idle timeout - waiting data
14:25:49 echo: dns,error DoH server connection error: Idle timeout - waiting data [ignoring repeated messages]
14:25:51 echo: dns,error DoH server connection error: Idle timeout - connecting
14:26:05 echo: dns,error DoH server connection error: Idle timeout - connecting
14:26:05 echo: dns,error DoH server connection error: Idle timeout - connecting [ignoring repeated messages]
14:44:30 echo: dns,error DoH server connection error: Idle timeout - waiting data
14:44:30 echo: dns,error DoH server connection error: Idle timeout - waiting data [ignoring repeated messages]
14:44:32 echo: dns,error DoH server connection error: Idle timeout - connecting
14:44:40 echo: dns,error DoH server connection error: Idle timeout - waiting data
14:44:40 echo: dns,error DoH server connection error: Idle timeout - connecting
14:44:50 echo: dns,error DoH server connection error: Idle timeout - connecting
14:44:50 echo: dns,error DoH server connection error: Idle timeout - connecting [ignoring repeated messages]
14:44:50 echo: dns,error DoH server connection error: Idle timeout - waiting data
14:44:50 echo: dns,error DoH server connection error: Idle timeout - connecting
14:44:52 echo: dns,error DoH server connection error: Idle timeout - connecting [ignoring repeated messages]
14:45:02 echo: dns,error DoH server connection error: Idle timeout - connecting
14:45:04 echo: dns,error DoH server connection error: Idle timeout - connecting [ignoring repeated messages]

I do not know who is it at fault here. But it doesn't look like RouterOS re-queries when this happens as browser gets stuck until I force a reload.

Amm0 · Tue Apr 29, 2025 3:16 am

Hmm, I'm just relaying on volume of posts in forum as metric here.... There was another thread about DoH and Quad9, where 1.1.1.1 folks reported as more stable than Quad9. Whether @normis is correct IDK

All other popular DoH services work with MikroTik without issue.

Are you using "verify server certificates" option? If you disable it, do the errors go away? That might narrow the problem.

Kentzo · Tue Apr 29, 2025 3:26 am

Hmm, I'm just relaying on volume of posts in forum as metric here....
Are you using "verify server certificates" option? If you disable it, do the errors go away? That might narrow the problem.

I mean it does mostly work. For end users this issue appears as a browser / application bug or internet connection hiccup. I'll check DoH without server verification and report.

Tue Apr 29, 2025 8:41 am

Quad9 announced that they are moving to HTTP2 required, RouterOS does not support it. Some of their servers now require it, some don't (yet). Maybe this is why it works sometimes, and sometimes not.

infabo · Tue Apr 29, 2025 9:33 am

Is http2 doh support on the ros roadmap? or even more modern: dns over quic?

Tue Apr 29, 2025 9:35 am

We need to make HTTP2 first, then DoH via HTTP2

Kentzo · Tue Apr 29, 2025 9:50 am

Are you using "verify server certificates" option? If you disable it, do the errors go away? That might narrow the problem.

Slightly different errors:

22:03:22 echo: dns,warning DoH max concurrent queries reached, ignoring query
22:03:22 echo: dns,warning DoH max concurrent queries reached, ignoring query [ignoring repeated messages]
22:50:13 echo: dns,warning DoH max concurrent queries reached, ignoring query
22:50:13 echo: dns,warning DoH max concurrent queries reached, ignoring query [ignoring repeated messages]
23:44:02 echo: dns,warning DoH max concurrent queries reached, ignoring query
23:44:02 echo: dns,warning DoH max concurrent queries reached, ignoring query [ignoring repeated messages]

Tue Apr 29, 2025 9:53 am

Well, increase "DoH max concurrent queries" setting

Kentzo · Tue Apr 29, 2025 10:03 am

Well, increase "DoH max concurrent queries" setting

It's already 2048 and cache (240KB / 4096KB) is on.

Does RouterOS count stale HTTP connection towards this limit?

infabo · Tue Apr 29, 2025 10:15 am

There are so many different other dns settings like timeout etc, it is for sure not only the concurrent queries knob involved here.

PS: now we know quad9 is problematic and switching to http2 - please add it to the incompatible list here: https://help.mikrotik.com/docs/spaces/R ... HTTPS(DoH)

Does DoH reliably work on RouterOS?

Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?

Re: Does DoH reliably work on RouterOS?