Solved how to troubleshoot: For certain DNS servers, DNS not resolving on clients, but do resolve on router

[voith13]

I have been using cleanbrowsing DNS servers, configured in my GT-AX11000 WAN DNS settings, and has been working for a few months. Clients are configured to use the router as DNS.
Suddenly stops working (clients no longer have DNS resolution).
Tried to play around with the WAN DNS options in the router and it turned out that specifying some DNS servers works while others dont. For example, setting it to use AdGuard's DNS works (DNS Server: 94.140.14.15, 94.140.15.16), but setting it to cleanbrowsing's does not (DNS Server: 185.228.168.10, 185.228.169.11). And both of those are stock options in the web gui for the router, as shown below.

And there are others that work, along with some others that dont work. Oddly enough, setting it to use the DNS from ISP also is not working. Entering a custom address also works for some, but not for others.

When using one of the DNS entries that don't work on the clients, SSH'ing into the router and running

nslookup google.com

(or any of a variety of domains) actually does work, but not when doing so on the client... it fails with (192.168.50.1 is my router's IP):

nslookup google.com
Server:        192.168.50.1
Address:    192.168.50.1#53

** server can't find google.com: SERVFAIL

Any ideas?

 

[dave14305]

What other DNS-related options are set on the WAN page? Does your router/firmware have DNSSEC enabled? That can cause issues if your chosen DNS servers don’t support it.

 

[bbunge]

Firmware and version on your GT-AX11000?

 

[voith13]

@bbunge :
Firmware: 3.0.0.4.388_24328-g1e6e634
Version: 2.410
I believe it's the latest.

Below are the other DNS related options set. Indeed, DNSSEC is enabled. I just tried disabling, and testing the other DNS servers that were not working and they are working now. Looks like this was it - thank you @dave14305 !