diff --git a/community-containers/dnsmasq/dnsmasq.json b/community-containers/dnsmasq/dnsmasq.json
new file mode 100644
index 00000000..d7377d12
--- /dev/null
+++ b/community-containers/dnsmasq/dnsmasq.json
@@ -0,0 +1,17 @@
+{
+    "aio_services_v1": [
+        {
+            "container_name": "nextcloud-aio-dnsmasq",
+            "display_name": "Dnsmasq (Local DNS)",
+            "documentation": "https://github.com/nextcloud/all-in-one/tree/main/community-containers/dnsmasq",
+            "image": "ghcr.io/szaimen/aio-dnsmasq",
+            "image_tag": "v1",
+            "internal_port": "host",
+            "restart": "unless-stopped",
+            "environment": [
+                "NC_DOMAIN=%NC_DOMAIN%",
+                "TZ=%TIMEZONE%"
+            ]
+        }
+    ]
+}
diff --git a/community-containers/dnsmasq/readme.md b/community-containers/dnsmasq/readme.md
new file mode 100644
index 00000000..25246451
--- /dev/null
+++ b/community-containers/dnsmasq/readme.md
@@ -0,0 +1,39 @@
+# Dnsmasq (Local DNS) community container
+
+This container runs [dnsmasq](https://thekelleys.org.uk/dnsmasq/doc.html) pre-configured to resolve your Nextcloud domain (`NC_DOMAIN`) to the server's local LAN IP address.
+
+## Why is this needed?
+
+By default, all devices on your LAN reach Nextcloud via the public internet (or require hairpin NAT on your router). With this container, LAN clients can resolve `NC_DOMAIN` directly to the server's private LAN IP, making local access faster and independent of your internet connection.
+
+This container is automatically enabled when you register a deSEC domain through the AIO interface.
+
+## How it works
+
+On startup the container:
+1. Detects the server's primary LAN IP address automatically.
+2. Configures dnsmasq to resolve `NC_DOMAIN` (and all its subdomains) to that IP.
+3. Forwards all other DNS queries to the upstream nameservers from the host's `/etc/resolv.conf`.
+4. Listens only on the LAN interface to avoid conflicts with any system DNS resolver (e.g. `systemd-resolved`).
+
+## Required router configuration
+
+⚠️ **You must change your router's DHCP settings** for this to take effect for LAN clients:
+
+Set the **DNS server** handed out by DHCP to the **local IP address of this server** (the same IP that is printed in the container logs on startup). After saving the change, LAN devices need to renew their DHCP lease (or be rebooted) before the new DNS setting takes effect.
+
+Most routers expose this under **DHCP settings → Primary DNS** or **LAN → DNS Server**.
+
+## Notes
+
+- This container should only be used in home networks as on public servers this might cause a security risk exposing a dns server publicly
+- This container is incompatible with the pi-hole community container as both need ports 53 to work correctly. Do not enable both at the same time!
+- The container runs in **host network mode** so it can bind directly to port 53 on the LAN interface. No additional port-forwarding is required.
+- IPv6 addresses are not handled by this container; extend the dnsmasq configuration manually if needed.
+- See https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers how to add it to the AIO stack
+
+### Repository
+https://github.com/szaimen/aio-dnsmasq
+
+### Maintainer
+https://github.com/szaimen
diff --git a/community-containers/pi-hole/readme.md b/community-containers/pi-hole/readme.md
index 69ad11ce..d8e545ea 100644
--- a/community-containers/pi-hole/readme.md
+++ b/community-containers/pi-hole/readme.md
@@ -3,6 +3,7 @@ This container bundles the [pi-hole](https://pi-hole.net/) ad blocker and auto-c
 
 ### Notes
 - You should not run this container on a public VPS! It is only intended to run in home networks!
+- This container is incompatible with the dnsmasq community container as both need ports 53 to work correctly. Do not enable both at the same time!
 - Make sure that no dns server is already running by checking with `sudo netstat -tulpn | grep 53`. Otherwise the container will not be able to start!
 - The DHCP functionality of Pi-hole has been disabled!
 - The data of pi-hole will be automatically included in AIOs backup solution!
diff --git a/community-containers/readme.md b/community-containers/readme.md
index f6da8758..c4b2156f 100644
--- a/community-containers/readme.md
+++ b/community-containers/readme.md
@@ -54,6 +54,7 @@ flowchart TD
     subgraph COMM_SEC["🔒 Security & Network"]
         F2B(["🚫  Fail2ban\nBrute-force protection"]):::community
         PIH(["🕳️  Pi-hole\nAd & DNS blocker"]):::community
+        DNSM(["📛  dnsmasq\nDNS & DHCP server"]):::community
         VW(["🔐  Vaultwarden\nPassword Manager"]):::community
         LDAP(["👥  LLDAP\nLight LDAP / Users"]):::community
         CADDY(["🌐  Caddy\nReverse Proxy + Geoblocking"]):::community