Add dns section to the free app. All of the following are readily available features of dnsmasq and likely already used by eero+.
- dnssec - ideally the dns cache would always use dnssec at a minimum. Preferably DoH or DoT but those aren't natively supported.
- DNS hijacking - add firewall/nat rules to redirect traffic to the specified server or the eero's cache if enabled.
- block/allow domains - allow adding limited number of domains to block or allow. This is critical for blocking DoH/DoT when hijacking DNS
- block/allow lists - allow adding urls to host lists to either allow or block. 50 lines of shell script can easily parse, format, dedup and sort these into a conf file for dnsmasq
- DHCP options - not directly dnsmasq but it would be nice to set custom dhcp options for tftp booting and such.