Building Resilient DoH Failover on MikroTik RouterOS to Handle Unreachable Cloudflare Responses
A branch office network suddenly stopped loading certain pages such as the Tailwind CSS CDN build that had worked reliably for weeks, while the rest of the internet remained accessible. Investigation on the MikroTik router revealed that :resolve returned valid addresses, DoH responded with Status:0, and the health monitor reported the upstream as healthy, yet clients experienced timeouts.
The root cause was two specific IP addresses returned by Cloudflare: 8.6.112.0 and 8.47.69.0. These were legitimate responses, but no route existed from the affected network segment to those prefixes. Standard resolver health checks that only verify whether an IP was received cannot detect this class of failure.
Initial DoH Deployment and Its Limitations
By default, RouterOS routes local DNS queries in plaintext toward the provider. Enabling DoH required a single command: /ip dns set use-doh-server=... verify-doh-cert=yes. The administrator selected the Cloudflare Family filtering resolver and initially considered the task complete.
Within days, reports arrived from the branch. Disabling DoH and testing plain DNS produced identical addresses, confirming the issue was not filtering but reachability. Client-side verification using curl --resolve demonstrated that the same IP worked from the main gateway yet timed out from the branch.
Requirements and RouterOS Constraints
The administrator defined three core requirements: all router-to-upstream traffic must use HTTPS with certificate validation, local clients must be forced through the router resolver, and automatic failover to a secondary DoH endpoint must occur on failure with automatic return on recovery.
RouterOS natively supports only one active DoH upstream. The often-recommended /ip dns static-server type=doh syntax does not exist in current versions. Bootstrap servers listed under servers= are used solely for initial name resolution of the DoH hostname and are not treated as fallback resolvers when DoH fails.
Health Monitor Evolution and Key Fixes
- Version 0.1.0 incorrectly accepted any IP-typed response, including the unreachable Cloudflare pair.
- Version 0.2.0 introduced content validation against known stub prefixes and switched to out-of-band HTTPS JSON probes to avoid disrupting active DoH sessions.
- Later versions added dual-threshold logic (failureThreshold=2, recoveryThreshold=2) to implement hysteresis and prevent flapping.
- Clock validation rejects dates outside 2025-2035 because an invalid system time breaks certificate verification and mimics upstream failure.
Static DNS entries were added for both primary and secondary DoH hostnames plus dns.google bootstrap addresses to break circular dependencies. The trust anchor SSL.com TLS ECC Root CA 2022 had to be imported because the built-in trust store does not cover the Cloudflare chain.
Current Architecture
The production configuration maintains four ordered stages: primary DoH, secondary DoH, optional tertiary DoH, and optional plain DNS as last resort. Only one stage is active at any time due to RouterOS limitations. The monitor script stores state in global variables, logs only on transitions, and performs pre-switch validation of the candidate endpoint plus post-switch verification before finalizing the change.
Testing confirmed that route injection or static hostname-to-reachable-IP mappings were the only effective remedies; merely changing the resolver brand never resolved the unreachable-prefix problem.
Related articles
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.