dnsmasq DNS Configuration

Merlin lets you extend dnsmasq with custom config files, which makes local DNS and policy-based DNS much easier to manage. On Merlin, dnsmasq.conf.add appends to the firmware-generated dnsmasq config instead of replacing it outright.¹

Edit /jffs/configs/dnsmasq.conf.add to append custom directives to the router's dnsmasq config. If you need to rewrite generated values rather than append new lines, prefer dnsmasq.postconf over replacing the whole config file.¹

Local Hostname Records

address=/proxmox.home/192.168.1.20
address=/nas.home/192.168.1.30
address=/openwebui.home/192.168.1.25

address= answers for the named domain and matching subdomains without forwarding those requests upstream.²

If nas.home is fronting the Proxmox-backed NAS tier in this lab, TrueNAS Shares And Proxmox Integration is the matching storage-side runbook for the NFS, SMB, and backup exports behind that name.

Block Domains Network-wide

address=/ads.example.com/#
address=/tracking.example.com/#
 
addn-hosts=/jffs/configs/blocklist.hosts

If you use addn-hosts, the referenced file must be in hosts-file format, not an AdGuard/uBlock filter list.²

Example hosts-format file:

0.0.0.0 telemetry.example.com
0.0.0.0 metrics.example.net

Using # in an address= rule tells dnsmasq to return the null addresses 0.0.0.0 and ::, which is usually cleaner than forcing only IPv4 localhost.²

Per-device DNS

dhcp-host=AA:BB:CC:DD:EE:01,iot-sensor,set:iot
dhcp-host=AA:BB:CC:DD:EE:02,guest-laptop,set:guest
 
dhcp-option=tag:iot,option:dns-server,149.112.112.112
dhcp-option=tag:guest,option:dns-server,1.1.1.1

Here the dhcp-host entries set tags, and the matching dhcp-option lines apply DNS-server overrides only to clients with those tags.²

Apply Changes Safely

ssh admin@192.168.1.1
dnsmasq --test
tail -f /var/log/messages | grep dnsmasq
# then restart dnsmasq from the router UI or reboot the router

Do not rely on SIGHUP for dnsmasq.conf.add edits. dnsmasq re-reads hosts-related files on HUP, but it does not re-read the main configuration file that way, so append-file changes need a real service restart or reboot.²