Getting Started

Getting started

Before you touch anything

A wrong CA or an untrusted chain stops all name resolution on the LAN. Take a backup first:

/export file=before-doh

Requirement	Why	Check
RouterOS 7.20+	use-doh-server, verify-doh-cert, certificate store	/system resource print → version:
NTP synchronized	TLS validation needs a correct clock	/system ntp client print → status: synchronized
device-mode known	on home, /tool fetch and /system scheduler add are rejected	/system device-mode print
Admin session	the import writes to the certificate store	/user print
The CA file on the router	import file-name= reads the router's filesystem	WinBox → Files, or scp
Interface names match	02 defaults to bridge bridge, lists LAN/WAN	/interface bridge print, /interface list print

device-mode=home is the one that surprises people: DoH and force-DNS work, but the automatic monitor cannot run (no fetch → no probe, no scheduler). Run the monitor by hand, or ask the owner to switch the device to advanced:

/system/device-mode/update device-mode=advanced   # needs physical confirmation + reboot

Order of application

# 0. upload certs/cloudflare-doh-ca.crt to the router first
/import file-name=00-install-ca.rsc          # trust anchor — without it DoH fails
/import file-name=01-configure-doh.rsc       # DoH + bootstrap static records
/import file-name=02-security-policies.rsc   # force LAN DNS to the router, protect it
/import file-name=05-dns-health-monitor.rsc  # content-aware check + failover

03-capsman.rsc and 04-cert-update.rsc are optional and independent.

What each step does

File	Effect
00-install-ca.rsc	imports SSL.com TLS ECC Root CA 2022 and marks it trusted
01-configure-doh.rsc	sets servers (bootstrap), use-doh-server (standard Cloudflare), pins A records for both endpoint hosts
02-security-policies.rsc	dstnat redirect of UDP/TCP 53 from the LAN bridge; accepts DNS from LAN, drops it from WAN
05-dns-health-monitor.rsc	creates the script and the 3-minute scheduler

First checks

/certificate print where trusted=yes          # expect: SSL.com TLS ECC Root CA 2022
/ip dns print                                  # use-doh-server=...; verify-doh-cert=yes
/ip dns static print where comment~"DoH bootstrap"   # two primary + two fallback addresses
/ip dns cache flush
:put [:resolve example.com]                    # 104.20.x / 172.66.x = real

If :resolve example.com returns 8.6.112.0 or 8.47.69.0, read Troubleshooting: that is the stub pair, and it is not a DoH failure.

Choosing a resolver

Resolver	Endpoint	Servers	When
Cloudflare standard (default)	https://cloudflare-dns.com/dns-query	1.1.1.1,1.0.0.1	normal use, no filtering
Cloudflare Security	https://security.cloudflare-dns.com/dns-query	1.1.1.2,1.0.0.2	you want malware blocking
Cloudflare Family	https://family.cloudflare-dns.com/dns-query	1.1.1.3,1.0.0.3	you want malware + adult blocking, and accept that some legitimate CDNs may answer with the stub pair
Google	https://dns.google/dns-query	8.8.8.8,8.8.4.4	used as the fallback in the default config
Quad9	https://dns.quad9.net/dns-query	9.9.9.9,149.112.112.112	works as DoH, but cannot be probed with the JSON API — see Troubleshooting

Working single-file examples: examples/cloudflare-standard.rsc and examples/cloudflare-family.rsc.