When having rules:
add action=accept chain=input comment="Allow A.B.C.D" log=yes src-address=A.B.C.D
add action=drop chain=input comment="Drop all" disabled=yes in-interface=internet

router cannot resolve DNS (located at the A.B.C.D address):
resolve domain-name="fqdn" server=A.B.C.D

in fact, no resolving works when the second rule is active.

This is an outgoing DNS request, not a traffic initiated by the A.B.C.D server.
You should allow the answer for that established outgoing session.
See the default first rule : "defconf: accept established,related,untracked"
There is no need to accept input from server A.B.C.D for those DNS queries. (Better close that door ?)

Thanks.
Works now.

I didn't expect that this would have to be explicitly set.