--auth-server=<domain>,[<interface>|<ip-address>...]

Enable DNS authoritative mode for queries arriving at an interface or address. Note that the interface or address need not be mentioned in --interface or --listen-address configuration, indeed --auth-server will override these and provide a different DNS service on the specified interface. The <domain> is the "glue record". It should resolve in the global DNS to an A and/or AAAA record which points to the address dnsmasq is listening on. When an interface is specified, it may be qualified with "/4" or "/6" to specify only the IPv4 or IPv6 addresses associated with the interface. Since any defined authoritative zones are also available as part of the normal recusive DNS service supplied by dnsmasq, it can make sense to have an --auth-server declaration with no interfaces or address, but simply specifying the primary external nameserver.