DNS Ad Blocking with MikroTik RouterOS Adlist

RouterOS includes a built-in DNS Adlist feature that imports hosts-format blocklists and blocks matching DNS requests by returning 0.0.0.0.

This setup uses:

• StevenBlack Hosts
• HaGeZi DNS Blocklists

Configure the DNS cache

Set the DNS cache to 64 MB and allow LAN clients to use the router as their DNS server:

/ip dns set cache-size=65536KiB allow-remote-requests=yes

For the hAP ax³, which has 1 GB of RAM, a 64 MB DNS cache is a sensible starting point for these two blocklists.

Add the blocklists

/ip dns adlist
add url="https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts" ssl-verify=yes
add url="https://raw.githubusercontent.com/hagezi/dns-blocklists/main/hosts/pro.txt" ssl-verify=yes

RouterOS automatically checks and reloads configured adlists every four hours, so no scheduler or custom update script is required.

To force an immediate reload:

/ip dns adlist reload

Verify the configuration

/ip dns adlist print detail

The most useful counters are:

• name-count — the number of DNS names successfully imported from the list
• match-count — the number of DNS queries that matched entries in the list

match-count counts requests, not unique domains or clients, so repeated lookups increase the value multiple times.

Test blocking

From a LAN client:

nslookup doubleclick.net 192.168.88.1

Replace 192.168.88.1 with the router’s LAN address. A blocked domain should resolve to:

0.0.0.0

Restrict DNS access

Never expose the RouterOS DNS resolver directly to the Internet.

See Also