#script
В качестве итога по DNS - мой конфиг для форварда DNS запросов средствами MT:
# L7
/ip firewall layer7-protocol add comment="DNS Forward - DMZ Servers" name=DNS-FLTR-01 regexp=".*corp-ext.ru.\?|.*corp-int.ru.\?|.*corp-ext34.ru.\?"
/ip firewall layer7-protocol add comment="DNS Forward - Drop queries of int-view to external NS" name=DNS-FLTR-02 regexp=".*corp-int.ru.\?"
# MANGLE
# alst-LOCAL-ALIAS = address-list for router's interfaces aliases to local networks;
# alst-LOCAL-NETS = address-list for local networks;
# alst-REMOTE-NETS = address-list for remote networks, which DMZ-segment is included in.
/ip firewall mangle add action=mark-connection chain=prerouting comment="Mark DNS queries for hosts of int-view" connection-state=new dst-address-list=alst-LOCAL-ALIAS dst-port=53 layer7-protocol=DNS-FLTR-01 new-connection-mark=dns-forward protocol=udp src-address-list=alst-LOCAL-NETS
/ip firewall mangle add action=mark-connection chain=output comment="DNS Forward - Drop queries to int-view to external NS"…

Действительно хрень полная