Didn't have much luck searching for this issue since every posted config contains this, so I hope you don't mind me posting this.
Odd problem with one of my clients. I couldn't Winbox to the HEX router via DNS.
Turns out the IP/Cloud was not working and system/packages wouldn't check for updates.
After trouble shooting, I found that this default entry in the filter was the issue. Or, at least when I disabled it, everything works.
10 ;;; defconf: drop all not coming from LAN chain=input action=drop in-interface-list=!LAN log=no log-prefix=""
Not seeing this issue on other routers. I have LAN list entries of the bridge and a capsman bridge I use for public access.
Tom