Using dnsmasq --address covers an entire domain, so dns.example.com AAAA queries would also return IPv6 addresses for example.com Instead, this was always meant to use host entries.