DNS Client and Cache · Topic 1 of 2

DNS Client and Cache

Learn how to set RouterOS DNS servers, allow remote requests so LAN hosts can use the router as resolver, and how the DNS cache stores answers.

  • 4 min
In a nutshell
  • DNS settings are in /ip dns.
  • servers holds the upstream resolvers, and dynamic-servers are learned and read only.
  • allow-remote-requests=yes lets LAN hosts use the router as their DNS server.

What it is

The RouterOS DNS service resolves names for the router itself and, if you allow it, for the LAN.

DNS turns a name such as a web site into an IP address. The router needs this for its own tasks, for example to reach an update server or an NTP host by name. The same service can also act as a small caching DNS server for your clients.

LAN hostasks the routerRouterDNS cachemissUpstream serverfrom the servers listanswerRouterstores in cache

The settings are in /ip dns.

How it works

The router forwards questions to its configured servers and remembers the answers.

Setting the servers

The servers parameter holds the upstream resolvers. You can list more than one, separated by commas.

/ip dns set servers=203.0.113.53,203.0.113.54
/ip dns print

The print output also shows dynamic-servers.

These are servers learned automatically, for example from a DHCP client or a PPP connection. You cannot edit them. Static servers and dynamic servers are both used.

SourceHow it appears
serversEntered by you
dynamic-serversLearned from DHCP client or PPP, shown read only

On a DHCP client, the setting use-peer-dns decides whether the DNS server from the provider is accepted. If you want only your own servers, set it to no.

Allowing remote requests

By default the router answers only its own questions. To let LAN hosts use the router as their resolver, enable remote requests.

/ip dns set allow-remote-requests=yes

With this setting on, the router answers DNS queries that arrive on its interfaces. Hosts then use the router address as their DNS server. A DHCP server can hand out the router address for this purpose.

LAN hostDNS server is the routerRouterallow remote requestsAnswerfrom cache or upstream

Protecting the resolver

Allowing remote requests also opens the service on the WAN side unless you block it. An open resolver can be abused in attacks. Add input filter rules that drop DNS queries from the internet.

/ip firewall filter add chain=input in-interface=ether1 protocol=udp dst-port=53 action=drop
/ip firewall filter add chain=input in-interface=ether1 protocol=tcp dst-port=53 action=drop
Watch out

If you enable remote requests, always drop DNS on the WAN interface. An open resolver can be used in amplification attacks.

The cache

The router stores each answer for the time given by the answer itself, called its TTL. When the same name is asked again within that time, the router replies from memory and does not ask upstream. After the TTL, the entry is removed.

Two settings control the cache.

SettingMeaning
cache-sizeHow much memory the cache may use
cache-max-ttlThe longest time an entry may be kept, even if its TTL is longer
/ip dns set cache-size=4096KiB cache-max-ttl=1d
/ip dns cache print
/ip dns cache flush

/ip dns cache print shows the stored entries. /ip dns cache flush removes all of them, which is useful after a DNS change when you do not want to wait for expiry. The print output of /ip dns print also shows cache-used, the memory used now.

A cache that is too small holds fewer answers, so more queries go upstream. Resolving still works.

Testing

You can test resolution from the router itself.

:put [:resolve example.com]

The :resolve command uses the same servers and cache as the rest of the router, so it shows what the router would answer.

Exam tip

If a name resolves on a PC but not on the router, compare the servers list with the DNS servers the PC uses, and check for a typing error in servers.

What to remember for the exam

Seven facts cover most questions on this topic.

  • DNS settings are in /ip dns.
  • servers holds the upstream resolvers, and dynamic-servers are learned and read only.
  • allow-remote-requests=yes lets LAN hosts use the router as their DNS server.
  • Remote requests should be blocked on the WAN side with input filter rules.
  • The cache keeps answers for their TTL, and cache-max-ttl caps that time.
  • /ip dns cache flush empties the cache.
  • use-peer-dns on a DHCP client decides whether the provider DNS server is used.

Common mistakes

These four mistakes appear often.

Giving clients the router as DNS without remote requests. The router ignores their queries, so lookups fail.

Leaving DNS open on the WAN. The router becomes an open resolver and can be abused.

Forgetting dynamic servers. An unexpected server from DHCP can appear in the list, so check use-peer-dns.

Waiting for a stale answer to expire. Flush the cache to see a change at once.

Check yourself

Work through these three questions.

  • Which setting lets LAN clients use the router as a DNS server?

    allow-remote-requests=yes in /ip dns.

  • What are dynamic servers?

    They are DNS servers learned automatically, for example from a DHCP client or PPP, and they are shown read only.

  • How do you remove all cached answers?

    Run /ip dns cache flush.

Topic 1 of 2 in DNS Client and Cache

Test yourself on DNS Client and Cache

The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.