Solved Solved

[Yota]

Solved

 

[RMerlin]

I can nslookup any website and confirm that the DNS server is not DoT but from my ISP

Which is normal, since DoT requires an accurate clock to work.

 

[RMerlin]

I think the RT-AC86U dnsmasq is still forwarding the dns requests to the upstream during this one-minute window. On my old 68U, dnsmasq does not seem to forward requests to the upstream, so I cannot resolve any websites, thus protecting me from the threat of DNS leaks.

Which would also mean it would be unable to resolve the NTP server address, preventing it from ever being able to synchronise it's clock.

Using the upstream resolver until the time NTP is set is perfectly normal, and required for DoT to ever become usable.

 

[Yota]

Which would also mean it would be unable to resolve the NTP server address, preventing it from ever being able to synchronise it's clock.

Using the upstream resolver until the time NTP is set is perfectly normal, and required for DoT to ever become usable.

I got it, thank you