The problem

I run dual stack throughout my network; IPv4 and IPv6. When using DNS over HTTPS (DoH) on Routeros, I would regularly receive DNS DoH timeout errors in my log, even when running ROS 7.23+ where the DoH implementation has been greatly improved. 

Introduction

This guide has been written around routeros 7.23.2 but should be applicable to earlier versions and has certainly been validated back to 7.19.0. It was written using a Mikrotik RB5009UG+s+ configured via Winbox 4.2.

There is a presumption that the reader understands the differences between IPv4 and IPv6, notably the fundamentals of how IPv6 works and the ‘direct connection’ model. In this guide, we will not cover IPv6 NAT. We will also assign static /64 prefixes to each of our VLANs (or single LAN), rather than issuing it from the pool.