Names do not resolve

You open a website and the browser says it cannot find the server. Type the IP address instead and the page appears. Pinging 1.1.1.1 works, pinging mikrotik.com does not.

That difference is the whole diagnosis. Your network works, your route out works, your firewall passes traffic. Only the lookup of names is broken. So this is not the same as no internet, and it has nothing to do with packet size.

The quick checks, in this order

1. Can the router resolve a name itself? /put [:resolve mikrotik.com]. A good answer: an IP address. An error means the router cannot reach its upstream, and there is no point looking at the client yet.
2. Which servers is the router using? /ip dns print. A good answer: servers holds the addresses you picked and allow-remote-requests: yes so clients may use it. If only dynamic-servers is filled, they came from your provider.
3. Does the client get the right server? /ip dhcp-server network print. A good answer: dns-server holds the router's address in that network. Then check on the client which DNS server it is really using.
4. Is the cache doing anything? /ip dns cache print. A good answer: entries you recognise. An empty cache while people are clicking means the queries never reach the router.
5. Is DNS being blocked or redirected? /ip firewall filter print stats and /ip firewall nat print. A good answer: the drop rule for DNS from WAN has a climbing counter (that is correct), and the port 53 redirect rule is only there if you asked for it.

The usual causes

• DNS over HTTPS that cannot find itself. To use the DoH server the router first has to resolve that server's name, which is exactly what is not working yet. The tool solves this with static records as a bootstrap, but a DoH URL you filled in by hand without such records leaves a router that resolves nothing at all.
• ISP DNS chosen, but nobody asks for it. Pick From the ISP as upstream and at least one uplink has to have Use ISP DNS ticked. Otherwise the router never learns an address to ask.
• The router may not be used as a DNS server. Turn Router as DNS server for the LAN off and the cache keeps working for the router itself while clients get nothing. A valid choice when you run your own resolver, a mistake otherwise.
• The client talks to something else. Phones and browsers ship their own DNS these days. Then the rest of the network is fine and one device is not.
• Adlist blocks more than intended. With the ad filter on and exactly one service missing, check whether that domain is on the list before you look further.

What the configurator does about it

The DNS section warns when you pick your provider's DNS while no uplink asks for it: ISP DNS chosen, but no WAN has "use ISP DNS" enabled. That is the check that makes this chapter unnecessary most often.

For DNS over HTTPS the script writes static records for the DoH server's hostname, pointing at the plain IP addresses of the same provider. That lets the router resolve that one name without DoH, and everything else over DoH afterwards. Tick Verify DoH certificate and the script also switches on the built-in trust store of RouterOS.

Choose Adlist while your target version is older than RouterOS 7.15 and the tool leaves it out and says so. And the Firewall section drops DNS queries from the internet by default so your router does not become an open resolver; that is the rule whose counter is supposed to climb.

What the tool does not do is check that your chosen upstream is actually reachable from your line. Providers that close port 53 outbound exist, and then /put [:resolve mikrotik.com] is the only thing that shows it.

When it is not your router

• The provider hijacks port 53. Some lines send all DNS to their own server. You notice when your chosen upstream returns answers that are not right. DNS over HTTPS solves that.
• The device has its own DNS. A laptop with a VPN client or a browser with DoH walks around your router. The option Force LAN clients through the router catches hard-coded addresses on port 53, but not browser DoH; the tool says so in the help text.
• The domain itself is broken. Test a second name before you blame your router.

Further reading: DNS, How DNS works and Firewall and NAT.