How to Configure DNS and DoH (DNS over HTTPS) on MikroTik Router

Every time someone on your network opens a website, sends an email, or streams a video, a DNS query happens first. By default, those queries are sent in plain text – meaning your ISP (or anyone between you and the DNS server) can see every domain your users visit. That's a privacy problem. It's also a security problem, because attackers can intercept and manipulate DNS responses (DNS spoofing) to redirect users to malicious sites.

MikroTik RouterOS gives you two powerful tools to fix this: a built‑in DNS cache/server that speeds up lookups for your entire LAN, and DNS over HTTPS (DoH) on RouterOS v7 that encrypts every DNS query leaving your router. This guide covers both – plus static entries, ad blocking, DNS bypass prevention, and performance tuning.

If you haven't set up your router yet, start with our beginner's MikroTik setup guide first.

Why DNS Matters for Security and Privacy

Here's what happens with standard unencrypted DNS:

• Your ISP logs every domain you visit – Even if the website uses HTTPS, the DNS query is visible.
• DNS spoofing/poisoning – Attackers on the network path can forge DNS responses, sending your users to phishing sites.
• Captive portal hijacking – Some ISPs redirect DNS to inject ads or block content.
• No authentication – Standard DNS (port 53) has zero verification that the response came from the real server.

DNS over HTTPS (DoH) solves these problems by wrapping DNS queries inside an encrypted HTTPS connection. Your ISP sees a connection to Cloudflare or Google – but can't see which domains you're resolving.

What We'll Set Up

1. MikroTik as a DNS server for your LAN (DNS cache)
2. Static DNS entries for local devices
3. Upstream DNS servers (Cloudflare, Google)
4. DNS over HTTPS (DoH) on RouterOS v7
5. DigiCert root certificate import for DoH validation
6. Firewall rules to force all clients through router DNS (block DNS bypass)
7. DNS‑based ad blocking
8. Cache size tuning for performance

Prerequisites

• A MikroTik router with RouterOS v7.1+ (DoH requires v7; DNS caching works on v6 too).
• WinBox, WebFig, or SSH access.
• Basic internet connectivity already working (WAN configured, NAT in place).
• A working firewall – see our MikroTik firewall basics guide if you haven't set one up yet.

Step 1: Enable the MikroTik DNS Cache (Make Your Router a DNS Server)

By default, MikroTik's DNS is configured to resolve queries for the router itself, but it doesn't serve DNS to LAN clients. Let's change that.

1.1 Set Upstream DNS Servers and Enable Remote Requests

/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes

WinBox: IP → DNS → set Servers to 1.1.1.1 and 8.8.8.8 → check Allow Remote Requests.

What this does:

• servers=1.1.1.1,8.8.8.8 – The router forwards queries it can't answer to Cloudflare (1.1.1.1) and Google (8.8.8.8) as fallback.
• allow-remote-requests=yes – The router now listens on port 53 and answers DNS queries from LAN clients. Without this, clients can't use the router as their DNS server.

Security note: Enabling allow-remote-requests opens port 53 on all interfaces – including your WAN. Your firewall's input chain must block DNS from the internet, or your router becomes an open DNS resolver (used for amplification attacks). If you followed our firewall guide, the default drop rule already handles this.

1.2 Point LAN Clients to the Router for DNS

Update your DHCP server to hand out the router's IP as the DNS server:

/ip dhcp-server network set [find] dns-server=192.168.88.1

WinBox: IP → DHCP Server → Networks → edit your network entry → set DNS Server to 192.168.88.1 (your router's LAN IP).

Replace 192.168.88.1 with your router's actual LAN address. After this, clients that renew their DHCP lease will use the router for DNS.

1.3 Verify DNS Is Working

/ip dns print
/ping google.com count=2

You should see your upstream servers listed and the ping resolving to an IP address. From a LAN client, try nslookup google.com 192.168.88.1 – the router should answer.

Step 2: Add Static DNS Entries for Local Devices

Static DNS entries let you access local devices by name instead of IP. Great for servers, printers, NAS boxes, or your router itself.

/ip dns static add name=router.local address=192.168.88.1
/ip dns static add name=nas.local address=192.168.88.50
/ip dns static add name=printer.local address=192.168.88.60
/ip dns static add name=server.local address=192.168.88.100

WinBox: IP → DNS → Static → Add New → enter Name and Address for each entry.

Now any device on the LAN can type http://nas.local instead of remembering 192.168.88.50.

Tip: Use a consistent naming convention like devicename.local or devicename.lan. Avoid using real TLDs like .com for local entries – it can cause conflicts.

Step 3: Configure Upstream DNS Servers

Choosing the right upstream DNS servers matters for both speed and privacy. Here are the most popular options:

For maximum privacy, use Cloudflare or Quad9. For malware blocking built into DNS, Quad9 is excellent.

To change your upstream servers:

/ip dns set servers=9.9.9.9,149.112.112.112

However, if you're about to enable DoH (next step), you can remove these entirely – DoH replaces the need for plain‑text upstream servers.

Step 4: Set Up DNS over HTTPS (DoH) on RouterOS v7

This is the main event. DoH encrypts all DNS queries from your router to the upstream resolver, so your ISP can't snoop on them. RouterOS v7 has native DoH support – no containers, no workarounds.

4.1 Import the DigiCert Root Certificate

DoH uses HTTPS, which means the router needs to verify the upstream server's TLS certificate. MikroTik doesn't ship with root certificates, so you must import one. Cloudflare and Google both use certificates signed by DigiCert.

/tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
/certificate import file-name=DigiCertGlobalRootG2.crt.pem passphrase=""

WinBox: System → Certificates → Import → select the downloaded .pem file → leave passphrase blank → Import.

Verify it's imported:

/certificate print
# You should see "DigiCert Global Root G2" with status flags: T (trusted)

Why DigiCert? Cloudflare's cloudflare-dns.com and Google's dns.google both chain to DigiCert root certificates. If you use a different DoH provider, check which root CA they use and import that instead.

4.2 Enable DoH

/ip dns set use-doh-server=https://cloudflare-dns.com/dns-query verify-doh-cert=yes

WinBox: IP → DNS → set Use DoH Server to https://cloudflare-dns.com/dns-query → check Verify DoH Certificate.

Alternative DoH URLs:

• Google: https://dns.google/dns-query
• Quad9: https://dns.quad9.net/dns-query

4.3 Remove Plain‑Text Upstream Servers (Optional but Recommended)

Once DoH is working, you can remove the traditional DNS servers so all queries go through the encrypted DoH channel:

/ip dns set servers=""

WinBox: IP → DNS → clear the Servers field.

Important: Keep at least one plain‑text server as fallback during initial setup. If the certificate is wrong or DoH can't connect, having 1.1.1.1 in the servers list means your router doesn't lose DNS entirely. Once you've confirmed DoH works, then remove them.

4.4 Verify DoH Is Working

# Clear the cache first
/ip dns cache flush

# Resolve a domain
:put [:resolve "example.com"]

# Check the cache – you should see entries
/ip dns cache print

If it resolves, DoH is working. To be absolutely sure the queries are encrypted, you can run a packet capture on your WAN interface and filter for port 53 – you should see zero plain‑text DNS traffic:

/tool sniffer quick port=53 interface=ether1

You should see HTTPS traffic to Cloudflare's IPs (104.16.x.x or 1.1.1.1) on port 443 instead.

Step 5: Block DNS Bypass (Force All Clients Through Router DNS)

Even after setting up DoH on your router, sneaky clients (smart TVs, IoT devices, apps with hardcoded DNS) can bypass your router and send DNS queries directly to Google, Cloudflare, or other servers. This defeats the purpose of your DNS configuration.

The fix: a firewall redirect rule that intercepts all outgoing DNS traffic and forces it through the router.

5.1 Redirect All DNS Queries to the Router

/ip firewall nat add chain=dstnat protocol=udp dst-port=53 action=redirect to-ports=53 comment="Force DNS through router (UDP)"
/ip firewall nat add chain=dstnat protocol=tcp dst-port=53 action=redirect to-ports=53 comment="Force DNS through router (TCP)"

WinBox: IP → Firewall → NAT → Add New → chain dstnat, protocol udp, dst-port 53, action redirect, to-ports 53. Repeat for TCP.

This intercepts any DNS query from any client – no matter what DNS server they've configured – and redirects it to the router's own DNS resolver. The router then resolves it via DoH.

5.2 Block DNS over TLS (DoT) Bypass

Some devices use DNS over TLS (port 853) instead of standard DNS. Block it to prevent bypass:

/ip firewall filter add chain=forward protocol=tcp dst-port=853 action=drop comment="Block DoT bypass"

5.3 Block Known External DoH Servers (Advanced)

Devices like Chrome and Firefox can use DoH directly, bypassing your router entirely. To block this, create an address list of known DoH server IPs and drop HTTPS traffic to them:

# Add known DoH server IPs to an address list
/ip firewall address-list add list=doh-servers address=8.8.8.8 comment="Google DoH"
/ip firewall address-list add list=doh-servers address=8.8.4.4 comment="Google DoH"
/ip firewall address-list add list=doh-servers address=1.1.1.1 comment="Cloudflare DoH"
/ip firewall address-list add list=doh-servers address=1.0.0.1 comment="Cloudflare DoH"
/ip firewall address-list add list=doh-servers address=9.9.9.9 comment="Quad9 DoH"
/ip firewall address-list add list=doh-servers address=149.112.112.112 comment="Quad9 DoH"

# Drop traffic from LAN to external DoH servers on port 443
/ip firewall filter add chain=forward dst-address-list=doh-servers protocol=tcp dst-port=443 action=drop comment="Block external DoH bypass"

Caution: This will also block normal HTTPS access to 1.1.1.1 and dns.google websites. For most networks this is fine, but be aware of it.

Important: Don't add the IP your router uses for its own DoH to this drop list if the router itself also needs to reach it! The redirect rule only affects dstnat (LAN clients), so the router's own outbound DoH (on port 443) won't be caught by the forward chain rule.

Step 6: DNS‑Based Ad Blocking (Static DNS Sinkhole)

You can block ads, trackers, and malware domains at the DNS level by pointing them to 0.0.0.0. This works like a lightweight Pi‑hole built into your router.

6.1 Add Static Entries for Ad Domains

/ip dns static add name=ads.google.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=pagead2.googlesyndication.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=ad.doubleclick.net address=0.0.0.0 comment="Ad block"
/ip dns static add name=analytics.google.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=graph.facebook.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=creative.ak.fbcdn.net address=0.0.0.0 comment="Ad block"
/ip dns static add name=pixel.facebook.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=ads.yahoo.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=adserver.yahoo.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=tracking.example.com address=0.0.0.0 comment="Ad block"

WinBox: IP → DNS → Static → Add New → Name = the ad domain, Address = 0.0.0.0.

How it works: When a client queries ads.google.com, the router returns 0.0.0.0 instead of the real IP. The browser's request fails silently – no ad loads.

6.2 Use a Regex Pattern to Block Entire Ad Subdomains (RouterOS v7)

RouterOS v7 supports regex in static DNS entries, so you can block entire patterns:

/ip dns static add regexp=".*\.ads\..*" address=0.0.0.0 comment="Block all .ads. subdomains"
/ip dns static add regexp=".*tracking.*" address=0.0.0.0 comment="Block tracking domains"

Be careful with regex – overly broad patterns can break legitimate sites. Test thoroughly.

6.3 Scaling Up: Script‑Based Block Lists

Manually adding hundreds of ad domains isn't practical. You can use a MikroTik scheduler script to fetch and import block lists automatically. Here's a basic approach:

# Fetch a block list and import (simplified example)
/tool fetch url="https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" dst-path=blocklist.txt
# Then parse and add entries via script (requires scripting knowledge)

For a full‑featured DNS sinkhole with automatic updates, consider running Pi‑hole in a container on MikroTik – it handles block list management much better than static DNS entries.

Step 7: DNS Cache Size Tuning

The DNS cache stores resolved queries so the router doesn't have to query upstream for every request. A larger cache means faster lookups for your LAN – especially useful for networks with many clients.

7.1 Check Current Cache Size and Usage

/ip dns print
/ip dns cache print count-only
/ip dns cache all print count-only

WinBox: IP → DNS → see Cache Size and Cache Used values.

7.2 Increase Cache Size

The default cache size is 2048 KiB. For most small networks (under 50 clients), this is fine. For larger networks or ISP deployments:

/ip dns set cache-size=8192
/ip dns set cache-max-ttl=1d

WinBox: IP → DNS → set Cache Size to 8192 KiB.

Guidelines:

• Home/small office (1–20 clients): 2048 KiB (default) is fine.
• Medium network (20–100 clients): 4096–8192 KiB.
• ISP/hotspot (100+ clients): 8192–16384 KiB. Watch your router's RAM usage.

Tip: Don't set cache-max-ttl too high. A maximum of 1d (1 day) is a good balance between performance and freshness. If a domain changes its IP, a stale cache causes issues.

7.3 Flush the Cache

If you're seeing stale results or just made changes to static entries:

/ip dns cache flush

WinBox: IP → DNS → Cache → click Flush Cache.

Step 8: Complete Copy‑Paste Script

Here's the entire DNS + DoH setup in one block. Adjust IPs and domains to match your network.

# ============================================
# MikroTik DNS + DoH Configuration Script
# RouterOS v7.1+ required for DoH
# ============================================

# --- Step 1: Import DigiCert root certificate for DoH ---
/tool fetch url=https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem
/certificate import file-name=DigiCertGlobalRootG2.crt.pem passphrase=""

# --- Step 2: Configure DNS with DoH ---
/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes cache-size=8192 cache-max-ttl=1d use-doh-server=https://cloudflare-dns.com/dns-query verify-doh-cert=yes

# --- Step 3: Point DHCP clients to router for DNS ---
/ip dhcp-server network set [find] dns-server=192.168.88.1

# --- Step 4: Static DNS entries for local devices ---
/ip dns static add name=router.local address=192.168.88.1
/ip dns static add name=nas.local address=192.168.88.50
/ip dns static add name=printer.local address=192.168.88.60

# --- Step 5: Force all clients through router DNS ---
/ip firewall nat add chain=dstnat protocol=udp dst-port=53 action=redirect to-ports=53 comment="Force DNS through router (UDP)"
/ip firewall nat add chain=dstnat protocol=tcp dst-port=53 action=redirect to-ports=53 comment="Force DNS through router (TCP)"

# --- Step 6: Block DNS bypass methods ---
/ip firewall filter add chain=forward protocol=tcp dst-port=853 action=drop comment="Block DoT bypass"

# Block external DoH servers (optional – blocks direct HTTPS DNS)
/ip firewall address-list add list=doh-servers address=8.8.8.8 comment="Google DoH"
/ip firewall address-list add list=doh-servers address=8.8.4.4 comment="Google DoH"
/ip firewall address-list add list=doh-servers address=1.1.1.1 comment="Cloudflare DoH"
/ip firewall address-list add list=doh-servers address=1.0.0.1 comment="Cloudflare DoH"
/ip firewall address-list add list=doh-servers address=9.9.9.9 comment="Quad9 DoH"
/ip firewall address-list add list=doh-servers address=149.112.112.112 comment="Quad9 DoH"
/ip firewall filter add chain=forward dst-address-list=doh-servers protocol=tcp dst-port=443 action=drop comment="Block external DoH bypass"

# --- Step 7: Basic ad blocking via DNS sinkhole ---
/ip dns static add name=ads.google.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=pagead2.googlesyndication.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=ad.doubleclick.net address=0.0.0.0 comment="Ad block"
/ip dns static add name=analytics.google.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=graph.facebook.com address=0.0.0.0 comment="Ad block"
/ip dns static add name=pixel.facebook.com address=0.0.0.0 comment="Ad block"

# --- Step 8: Remove plain-text servers once DoH is confirmed working ---
# Uncomment the next line after verifying DoH works:
# /ip dns set servers=""

# --- Verify ---
/ip dns cache flush
:put [:resolve "example.com"]
/ip dns print

Troubleshooting

DNS Not Resolving at All

• Router can't resolve: Run :put [:resolve "google.com"]. If this fails, your upstream servers or DoH URL is wrong. Try temporarily adding servers=1.1.1.1 and disabling DoH to isolate the issue.
• Clients can't resolve: Check that allow-remote-requests=yes is set. Verify the client is getting the router's IP as DNS (run ipconfig /all on Windows or resolvectl status on Linux).
• Firewall blocking DNS: Make sure your input chain allows DNS from LAN clients. If you have a strict firewall, add:

/ip firewall filter add chain=input protocol=udp dst-port=53 src-address=192.168.88.0/24 action=accept comment="Allow LAN DNS"
/ip firewall filter add chain=input protocol=tcp dst-port=53 src-address=192.168.88.0/24 action=accept comment="Allow LAN DNS TCP"

Place these before your drop‑all rule.

DoH Certificate Errors

• "SSL: handshake failed" – The root certificate isn't imported or isn't trusted. Re‑import it and check with /certificate print – look for the T (trusted) flag.
• Certificate expired: DigiCert Global Root G2 is valid until 2038, but intermediates rotate. Re‑download and re‑import if you see expiry errors.
• Wrong certificate for provider: If you're using Quad9 or another provider, they may use a different root CA. Check their documentation.
• Router clock is wrong: TLS certificate validation depends on the system clock. If your router's time is wrong, certificates will fail validation. Fix it:

/system ntp client set enabled=yes
/system ntp client servers add address=time.cloudflare.com

Slow DNS Lookups

• First query is slow, subsequent ones are fast: This is normal – the first query goes to the upstream/DoH server, then gets cached. Increase cache-size if you have many unique domains.
• All queries are slow: DoH adds latency compared to plain DNS (HTTPS handshake overhead). Try switching to a closer DoH provider. Cloudflare and Google have edge servers worldwide.
• Cache keeps filling up: Increase cache-size. Monitor with /ip dns cache print count-only.

Clients Bypassing Router DNS

• Smart TVs, Chromecast, IoT devices often have hardcoded DNS (usually 8.8.8.8). The redirect rules from Step 5 fix this.
• Apps using DoH directly: Firefox, Chrome, and some apps use their own DoH. The address list block from Step 5.3 handles this.
• VPN apps: If a client is using a VPN, their DNS goes through the VPN tunnel and bypasses your rules entirely. This is by design and can't be blocked without blocking the VPN itself.

Static DNS Entries Not Working

• Flush the cache: /ip dns cache flush.
• Check the entry is correct: /ip dns static print.
• Make sure the client is actually using the router for DNS (check with nslookup devicename.local 192.168.88.1).

Security Considerations

• Block DNS from WAN: Never leave port 53 open to the internet. Your firewall's input drop rule should handle this, but verify with an external port scan.
• DoH doesn't hide everything: Your ISP can still see the IP addresses your router connects to (via SNI in TLS or simply by IP). DoH hides the domain names in DNS queries, not the actual connections.
• Consider DNSSEC: RouterOS v7 supports DNSSEC validation. Enable it for an extra layer of verification (but it doesn't encrypt queries – that's what DoH is for).
• Combine with firewall rules: DNS security is just one layer. Pair it with a solid firewall configuration for comprehensive protection.

ISP and Hotspot Operators: DNS with MikroRadius

If you're running a hotspot or PPPoE network with many clients, DNS performance directly impacts user experience. A properly configured DNS cache on your MikroTik reduces upstream queries, speeds up browsing for your subscribers, and gives you control over what domains are accessible.

Pair this DNS setup with MikroRadius for centralised user management, bandwidth control, and billing – while your router handles fast, private DNS resolution for all connected users.

Conclusion

DNS is one of those things that's easy to overlook – until it breaks, or until you realise your ISP has been logging every website your network visits. With this setup, your MikroTik router now:

• ✅ Serves as the central DNS resolver for your entire LAN
• ✅ Encrypts all outbound DNS queries via DoH
• ✅ Prevents clients from bypassing your DNS (even hardcoded ones)
• ✅ Blocks ads and trackers at the DNS level
• ✅ Resolves local devices by friendly names
• ✅ Caches queries for faster performance

That's a lot of value from a feature that most people leave at the default. Take 10 minutes to set this up – your network will be faster, more private, and more secure.

For your next step, make sure your firewall is properly configured to complement this DNS setup. And if you're just getting started with MikroTik, our beginner's guide covers everything you need to get a safe, working router before layering on DNS security.