DNS#

Services → DNS, at /dns. Four tabs: Forwarding, Local names, Dynamic DNS and mDNS, plus CLI in Advanced mode. This page documents the first two; Dynamic DNS and mDNS repeater have pages of their own.

The resolver is the router answering DNS for the hosts behind it: sending what it does not know to the servers upstream, caching the answers, and answering for the names you give it itself. Everything the tabs show can be changed from them. Like every editor in the product, a form adds to the pending changes, and nothing reaches the router until you apply them from the bar at the bottom of the page.

Forwarding#

Without a resolver#

A router with no resolver shows DNS forwarding is off and a Turn on DNS forwarding button. The form it opens is filled in from the router's own networks: it answers on the router's address on every interface that does not carry the default route, allows the networks those addresses are in, and forwards to the router's own DNS servers (the ones in the system settings). Check the lists and save.

The tiles#

Tile	What it shows
Cached answers	how many answers the cache holds, and the most it will hold
Cache memory	what the cache occupies, as the router reports it
Upstream servers	how many servers questions are sent to, and which
Local names	records plus host names: everything the router answers for itself

The first two are live figures from the running resolver. A dash means the router did not report that figure.

The settings#

The Forwarding panel lists the settings, and Edit opens them:

Field	What it does
Upstream servers	where questions the router cannot answer are sent. Each server has an address and, when it is not 53, a port — a local ad-blocking or encrypting resolver often listens on another
Use the router’s own DNS servers	also forward to the DNS servers in the router's system settings
Use DNS servers learned by DHCP on	also forward to the servers an interface learned from its DHCP server, typically the uplink's
Listen addresses	the router's addresses that answer DNS queries
Allowed networks	the clients that may use the resolver
Cache size	how many answers are kept, 10000 when unset
Negative cache time	how long "no such name" answers are kept, in seconds
DNSSEC	how signed answers are treated, below

Save stays unavailable while the form cannot be applied, and says why: the router needs at least one listen address and one allowed network, and somewhere to forward to.

Turn off removes the resolver, and with it every record and forwarded domain, since those live inside it. It asks before it does.

DNSSEC#

Setting	Behaviour
Pass signatures through without validating	the default: signatures go to clients that ask, nothing is checked
Validate for clients that ask	checks signatures for a client that sets the flag for it
Validate and log failures	checks every signed answer and logs the ones that fail, but still returns them
Validate every answer	a signed answer that fails is refused (SERVFAIL)
Off	no DNSSEC processing

Validate every answer is the protective setting. A private domain whose server does not sign its answers then needs Validate DNSSEC turned off under domain forwarding, below, or its names stop resolving.

Domain forwarding#

Questions for one domain can go to a different server from everything else — the office domain to the office's DNS server, a lab domain to the lab's. This is split DNS from the router's side: the rest of the internet still resolves through the upstream servers.

The Domain forwarding table lists each domain, its servers, whether they are resolvers, and whether its answers are validated. Add domain and a click on a row open the same form:

Field	What it does
Domain	the domain, and every name under it
Servers	where its questions go, each with an optional port
Recursive servers	on when the servers are resolvers (another router, an ad-blocker); off when they are the domain's own name servers
Validate DNSSEC	off for a private domain whose server does not sign its answers

Delete stops forwarding the domain after asking.

Local names#

Two tables: names the router answers from its host list, and records in zones it answers for.

Host names#

The simplest way to give a device a name. Each entry is a name, one or more addresses and any aliases; the router answers for it, and uses it itself. Add host name and a click on a row open the form; Delete asks first.

Host names do not need the resolver's settings, and they do not take over a domain: a host name nas.home.example.net answers for that name and nothing else.

Records#

The Records table lists every record the router answers for, as Name, Type, Value, TTL and Zone. The name reads the way a client asks for it: the zone itself is the zone's name, and a wildcard reads *. in front of it. A record turned off carries Off.

Add record and a click on a row open the record form. It asks for the zone, the type and the name, then for what that type holds:

Type	Holds
A, AAAA	one or more IPv4 or IPv6 addresses
CNAME	another name
MX	mail servers, each with a priority (10 when unset; lower is tried first)
NS	the name servers of a delegated subdomain
PTR	a name, for a reverse lookup
TXT	one or more text values
SPF	one sender-policy value
SRV	targets, each a host and port with a priority and weight
NAPTR	rules: order, preference, flags, service, expression, replacement

Every record also takes a TTL in seconds (300 when unset) and a Disabled switch, which keeps the record and stops answering it. Changing the zone, the type or the name replaces the record: the old one is removed in the same change.

The name is @ for the zone itself and * for every name in the zone that has no record of its own — a wildcard. Only A and AAAA records can be wildcards. The router stores the wildcard as any, which is the only spelling its configuration accepts; the page shows and takes *.

Delete record asks first. Deleting the only record in a zone deletes the zone too.

Zones#

A zone is every name under a domain, answered by the router. The Zones table lists each zone with its record count; a click opens it, with an Answer for this zone switch and Delete zone, which removes every record in it after asking how many that is.

Pending changes#

The Commit Bar lists what the editors staged as sentences: Change DNS forwarding settings — Cache size 20000, DNSSEC “Validate every answer”, Forward corp.example.net to 192.0.2.53, Add DNS record nas.home.example.net (A) — Address 192.0.2.10. In Advanced mode each editor also shows the commands it will stage, and the CLI tab shows the whole of service dns as the router's commands.

A dynamic DNS password is never in any of it: see Dynamic DNS.

What breaks if you get it wrong#

Clients pointed at an address the resolver does not listen on. Check the listen addresses against the DNS servers the DHCP scope hands out — see DHCP.
Allowed networks narrower than your networks. A new VLAN gets addresses and no name resolution, and it looks like a DHCP fault.
A zone that swallows a public domain. Described above. One name works and everything else in the domain stops.
Validate every answer, and a private domain. Its unsigned answers are refused. Turn off Validate DNSSEC for that domain.
A CNAME for the zone itself. A CNAME at @ is invalid DNS and behaves unpredictably even where it is accepted.
Cache size raised past what the box can hold. The resolver competes with everything else on the router for memory.

Worked example: split-horizon for your own domain#

The reference workload answers *.example.net with the address of the server that publishes those names, so that inside the network every name under the domain goes straight to it rather than out to the public address and back.

Services → DNS, Local names, Add record.
Zone example.net, type A, name *, address 192.0.2.10. Save.
Add record again: the same zone, name @, the same address, for the domain itself. Save.
Apply the changes. The records read *.example.net and example.net.
Check it the way a client would, through the router's own resolver: the Diagnostics page's lookup tool asks the router, which is the answer your clients get — see Diagnostics → Tools.

If the lookup returns nothing, the client is usually not using this resolver at all: look at the DNS servers the DHCP scope hands out.

App integrations#

Installed apps can offer configuration for this page — an ad-filtering or DNS container offering to become the upstream, for instance. Offers appear between the header and the tabs, and only when an app declaring a hint for the dns page is installed. An offer may carry placeholders — the router's own address and its domain among them — which are filled from this router's configuration first; the full list is on Integration offers.