Building Fault-Tolerant DoH on MikroTik RouterOS to Avoid Unreachable Cloudflare Responses
A network administrator encountered a puzzling issue in a branch network where pages using Tailwind CSS from CDN would timeout despite valid DNS resolutions through DoH. The problem stemmed from Cloudflare returning IP addresses like 8.6.112.0 and 8.47.69.0 that had no reachable route from the affected network segment. RouterOS supports only a single active DoH upstream, requiring custom scripting to implement failover between multiple endpoints while maintaining HTTPS encryption and certificate verification. Early script versions failed by checking only response types instead of content validity, temporarily disabling DoH during probes, and falling back to plain DNS that delivered spoofed answers. The refined solution uses static bootstrap entries, JSON API probes with proper timeouts, hysteresis thresholds for state transitions, and verification against known stub prefixes. Certificate trust anchors had to be manually addressed because builtin-trust-store does not cover the SSL.com root used by Cloudflare. The final monitor script runs every 60 seconds, checks date validity to prevent certificate failures, and limits switch attempts to avoid log flooding while ensuring the backup endpoint is tested before and after any transition.
HabrOct 31, 2026Translated from Russian