It's surprising to me that dnsmasq doesn't provide the ability to override the returned names in the chain. I'd just assumed it did. Seems like it shouldn't be _that_ hard to solve, though. I've written my own bespoke DNS server before on top of miekg/dns - I might have to take a crack at my own pihole-like with CNAME interception. :)