dnsmasq can be configured to only accept queries from at-most-one-hop-away addresses using the option local-service . Other queries are discarded in this case.
This is meant to be a safe default to keep otherwise unconfigured installations safe. Note that local-service is ignored if any access-control config is in place ( interface , except-interface , listen-address or auth-server ).