MikroTik RouterBoard 951-2n

(may be relevant for other models)

A DNS server is not running by default, but can be configured under /ip dns (or the "IP / DNS" GUI menu), in which case the router will act as an open DNS resolver.

A firewall filter rule can prevent incoming DNS traffic on the WAN interface:

 /ip firewall filter
 add chain=input action=drop protocol=tcp in-interface=pppoe-out1 dst-port=53
 add chain=input action=drop protocol=udp in-interface=pppoe-out1 dst-port=53

(replace ppoe-out1 with your external interface name obtained from /interface print).

You can also configure this in the GUI under "IP / Firewall / Filter Rules":

Thanks to Jay Pudasaini for the general solution.