DNS

DNS turns names into addresses. When it fails it looks like "the internet is broken", while the connection itself is perfectly fine. The configurator puts the router in the middle by default: every device asks it, it asks upstream, and it remembers the answer.

Where it sits

The DNS section is on by default. The wizard asks two questions (upstream and DNS over HTTPS), advanced shows the rest.

Why put the router in between

A cache on the router saves time on every question that has been asked before, and it gives you one place to arrange things: a name for your NAS, a blocked domain list, a filter. That is why DNS server for clients in LAN and DHCP defaults to "the router itself", and the same choice exists per VLAN. If you want clients to talk straight out, you put other servers there.

Choosing an upstream

• Quad9 (the default) filters out known malware domains.
• Cloudflare and Google are fast and filter nothing.
• From the ISP uses whatever arrives over DHCP or PPPoE. At least one WAN connection then has to have Use ISP DNS switched on; the tool warns you when none does.
• Custom for your own servers, a domain controller or a Pi-hole for instance: fill in the addresses separated by commas.

There is no technically correct choice here. Your ISP sees which addresses you reach anyway; a different resolver moves who sees your questions, it does not make them disappear. Choose deliberately and know what you moved.

DNS over HTTPS

With DoH on, your questions go encrypted to the chosen upstream, so they are not readable along the way. The tool writes use-doh-server with the URL belonging to your choice; for your own resolver you fill the URL in yourself. Verify certificate is on and enables the built-in trust store of RouterOS; importing a CA bundle separately is not needed on RouterOS 7.

There is a chicken-and-egg problem in this: to reach the DoH server its name has to be looked up first, and that cannot go over DoH yet. The configurator solves it by adding static records for that hostname pointing at the plain addresses of the same provider. You can see them in the script with the comment bootstrap DoH.

Static records

At the bottom you add names that only exist inside your own network: nas.lan.example.nl to 192.168.10.20. The types on offer are A, AAAA, CNAME and regexp. For a CNAME you put the name it points at in the address column. With regexp the pattern matches names instead of one name, which is how you send a whole domain to an address or let it run into a wall.

Static records are also the tidy answer to hairpin NAT: point the name at the internal address from inside and traffic does not have to go round via your public address. See Opening a port.

Forcing clients

The force LAN clients through the router switch puts a redirect on port 53: every DNS question from the LAN aimed at another server ends up at the router anyway. Useful against devices with a hard-coded 8.8.8.8, cameras and smart TVs especially. It does not stop DoH in browsers, because that runs over port 443 and is indistinguishable from ordinary web traffic from the outside.

Not ending up an open resolver

To let the router resolve for your network, allow-remote-requests=yes has to be on, and that means literally: it answers questions from outside too. An open resolver is abused within days to amplify attacks. That is why the explicitly drop DNS requests from WAN switch in the Firewall section is on by default: two rules in the input chain for udp and tcp 53 with in-interface-list=WAN.

With the default rules present, WAN traffic to the router is dropped by the closing rule anyway. The explicit rules are there because they are visible and stay put when somebody later rearranges the rest. Leave them on.

Adlist

From RouterOS 7.15 the router can read a hosts list and let those domains run into a wall. The Adlist switch adds the StevenBlack list. Pick an older target version and the tool leaves it out and says why. Expect some memory use and the occasional broken site; then you take it off again.

What you can check

• /ip dns print shows the servers, the cache and whether remote requests are on.
• /ip dns cache print shows what has been remembered.
• /ip dns static print for your own records and the DoH bootstrap.
• If an address works and a name does not, the problem is here and not in your connection.
• Switch router as DNS server for the LAN off while IPv6 still advertises the router as DNS and the tool warns you: clients then get a resolver that does not answer.

Further reading: Firewall and NAT, LAN and DHCP and IPv6.