diff --git a/examples/docker-network/Dockerfile b/examples/docker-network/Dockerfile
index 6145f2a..96c0986 100644
--- a/examples/docker-network/Dockerfile
+++ b/examples/docker-network/Dockerfile
@@ -2,7 +2,8 @@ FROM debian:bookworm-slim
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
-        iproute2 iputils-ping dnsutils openssh-client openssh-server iperf3 && \
+        iproute2 iputils-ping dnsutils openssh-client openssh-server iperf3 \
+        dnsmasq curl python3 && \
     rm -rf /var/lib/apt/lists/*
 
 # Setup SSH server with no authentication (test only!)
@@ -13,8 +14,18 @@ RUN mkdir -p /var/run/sshd && \
     sed -i 's/UsePAM yes/UsePAM no/' /etc/ssh/sshd_config && \
     passwd -d root
 
+# dnsmasq: forward .fips to FIPS daemon, everything else to Docker DNS
+RUN printf '%s\n' \
+    'port=53' \
+    'listen-address=127.0.0.1' \
+    'bind-interfaces' \
+    'server=/fips/127.0.0.1#5354' \
+    'server=127.0.0.11' \
+    'no-resolv' \
+    >> /etc/dnsmasq.conf
+
 COPY fips /usr/local/bin/
 RUN chmod +x /usr/local/bin/fips
 
-# Start SSH server and iperf3 server in background, then run FIPS
-ENTRYPOINT ["/bin/bash", "-c", "/usr/sbin/sshd && iperf3 -s -D && exec fips --config /etc/fips/fips.yaml"]
+# Start dnsmasq, SSH server, and iperf3 in background, then run FIPS
+ENTRYPOINT ["/bin/bash", "-c", "dnsmasq && /usr/sbin/sshd && iperf3 -s -D && exec fips --config /etc/fips/fips.yaml"]
diff --git a/examples/docker-network/configs/node.template.yaml b/examples/docker-network/configs/node.template.yaml
index 27a64c6..8228402 100644
--- a/examples/docker-network/configs/node.template.yaml
+++ b/examples/docker-network/configs/node.template.yaml
@@ -14,7 +14,6 @@ tun:
 dns:
   enabled: true
   bind_addr: "127.0.0.1"
-  port: 53
 
 transports:
   udp: