## disable systemd-resolved

```bash
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/disable-stub.conf <<EOF
[Resolve]
DNSStubListener=no
EOF

# Fix /etc/resolv.conf symlink so the box itself still resolves
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf

sudo systemctl restart systemd-resolved
```


## dnsmasq in ts2 namespace

```bash
sudo mkdir -p /etc/dnsmasq-ts2
sudo tee /etc/dnsmasq-ts2/dnsmasq.conf <<'EOF'
# Inside ts2 netns — tailscale0 is the only real interface.
# Bind to all (namespace is isolated, so this is safe).
no-resolv
no-hosts

# Upstreams (explicit, no /etc/resolv.conf dependency inside netns)
server=1.1.1.1
server=9.9.9.9

# Zone
local=/intranet/
domain=intranet

address=/psmf.intranet/100.90.25.77
address=/psmf-new.intranet/100.90.25.77

cache-size=1000
log-facility=/var/log/dnsmasq-ts2.log

user=dnsmasq
pid-file=/run/dnsmasq-ts2.pid
EOF
```

```bash
# systemd-unit
sudo tee /etc/systemd/system/dnsmasq-ts2.service <<'EOF'
[Unit]
Description=dnsmasq inside ts2 netns (intranet zone)
After=network-online.target
Wants=network-online.target
# If you have a unit that sets up the ts2 namespace + tailscaled inside it,
# add it here, e.g.:
# Requires=tailscaled-ts2.service
# After=tailscaled-ts2.service

[Service]
Type=simple
NetworkNamespacePath=/var/run/netns/ts2
ExecStartPre=/usr/sbin/dnsmasq --test -C /etc/dnsmasq-ts2/dnsmasq.conf
ExecStart=/usr/sbin/dnsmasq -k -C /etc/dnsmasq-ts2/dnsmasq.conf
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
```

```bash
# validate and start
sudo systemctl daemon-reload
sudo systemctl enable --now dnsmasq-ts2
sudo systemctl status dnsmasq-ts2 --no-pager


sudo ip netns exec ts2 ss -lnup | grep :53
sudo ip netns exec ts2 dig @127.0.0.1 psmf.intranet +short
sudo ip netns exec ts2 dig @127.0.0.1 cloudflare.com +short
```


## dnsmasq in root namespace

```bash
sudo mkdir -p /etc/dnsmasq-root
sudo tee /etc/dnsmasq-root/dnsmasq.conf <<'EOF'
# Root netns instance. Stock dnsmasq.service must be disabled/masked
# so it doesn't fight us for port 53.
# systemd-resolved stub listener is disabled (see top of this file).

# Only listen on these — don't grab :53 on every interface.
bind-interfaces
interface=br0
interface=tailscale0

# Upstreams (explicit, no /etc/resolv.conf lookup)
no-resolv
no-hosts
server=1.1.1.1
server=9.9.9.9

# Zone
local=/intranet/
domain=intranet

address=/psmf.intranet/100.90.25.77
address=/psmf-new.intranet/100.90.25.77

cache-size=1000
log-facility=/var/log/dnsmasq-root.log

user=dnsmasq
pid-file=/run/dnsmasq-root.pid
EOF
```

```bash
# systemd-unit
sudo tee /etc/systemd/system/dnsmasq-root.service <<'EOF'
[Unit]
Description=dnsmasq in root netns (intranet zone)
After=network-online.target
Wants=network-online.target
# Make sure the stock apt dnsmasq is out of the way:
# sudo systemctl disable --now dnsmasq
# sudo systemctl mask dnsmasq

[Service]
Type=simple
ExecStartPre=/usr/sbin/dnsmasq --test -C /etc/dnsmasq-root/dnsmasq.conf
ExecStart=/usr/sbin/dnsmasq -k -C /etc/dnsmasq-root/dnsmasq.conf
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
```

```bash
# validate and start
sudo systemctl daemon-reload
sudo systemctl enable --now dnsmasq-root
sudo systemctl status dnsmasq-root --no-pager

# verify it's bound only on br0 + tailscale0 (not on lo, not 0.0.0.0)
sudo ss -lnup | grep :53

# smoke test against the host's own br0 / tailscale0 IP
BR0_IP=$(ip -4 -o addr show br0        | awk '{print $4}' | cut -d/ -f1)
TS0_IP=$(ip -4 -o addr show tailscale0  | awk '{print $4}' | cut -d/ -f1)
dig @"$BR0_IP" psmf.intranet  +short
dig @"$TS0_IP" psmf.intranet  +short
dig @"$BR0_IP" cloudflare.com +short
```