MikroTik RouterOS: DNS filtering for the whole LAN with dnsdome

What we are building

The router resolves for the LAN, the router forwards to dnsdome, and a firewall rule makes sure nothing on the LAN talks to any other DNS server. Every device, including TVs and IoT, is filtered without touching it. This works on RouterOS 6 and 7; the encrypted upstream needs RouterOS 7.

Step 1: upstream to dnsdome

RouterOS 7 with DNS-over-HTTPS (recommended)

With DoH the token in the URL identifies your profile, so a dynamic WAN IP never breaks filtering. Copy the DoH address from your profile's Encrypted DNS card in the panel.

1. Install a CA bundle so the router can verify the certificate, once:

   /tool fetch url=https://curl.se/ca/cacert.pem
   /certificate import file-name=cacert.pem passphrase=""

2. Point DNS at dnsdome and enable DoH. The plain server is kept so the router can resolve the DoH hostname itself:

   /ip dns set servers=87.244.198.165 allow-remote-requests=yes \
       use-doh-server="https://dns.dnsdome.com/dns-query/<token>" verify-doh-cert=yes

3. Pin the DoH hostname so bootstrap never depends on another resolver:

   /ip dns static add name=dns.dnsdome.com address=87.244.198.165

RouterOS 6, or plain DNS

/ip dns set servers=87.244.198.165 allow-remote-requests=yes

Add the router's public WAN IP to the profile's allowlist in the panel. If the WAN IP is dynamic, upgrade to RouterOS 7 and use DoH, or re-add the IP when it changes.

Step 2: hand the router out as DNS

/ip dhcp-server network set [find] dns-server=192.168.88.1

Replace with your LAN gateway address. Clients now ask the router, and the router asks dnsdome. Renew a lease on a client, or wait for the lease to refresh.

Step 3: catch hard-coded DNS

Google devices, some TVs and a few apps ignore DHCP and query 8.8.8.8 directly. Redirect all LAN port-53 traffic to the router:

/ip firewall nat add chain=dstnat in-interface-list=LAN protocol=udp dst-port=53 action=redirect to-ports=53 comment="DNS to router"
/ip firewall nat add chain=dstnat in-interface-list=LAN protocol=tcp dst-port=53 action=redirect to-ports=53 comment="DNS to router"

Optionally block DNS-over-TLS to third parties so devices cannot bypass with their own encrypted resolver:

/ip firewall filter add chain=forward in-interface-list=LAN protocol=tcp dst-port=853 action=reject comment="no third-party DoT"

Step 4: verify

/ip dns cache flush
/tool dns-lookup doubleclick.net

From a client, nslookup doubleclick.net should return the block response and the panel's query log should show the query under your profile within a minute. Under /ip dns, the DoH counters increase when the encrypted path is in use.

Several sites, several profiles

Each dnsdome profile has its own token and its own rules. A router per branch, each with its own DoH URL, gives every site its own policy and its own log, with all of them in one account. The Business plan has unlimited profiles.