diff --git a/doc/guix.texi b/doc/guix.texi
index 68c75f1416..0102fd0fad 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -33635,6 +33635,10 @@ separated by dashes, e.g.: @samp{01-02-03-04-aa-bb}.  Note that
 resolving MAC addresses is only possible if the client is in the local
 network or obtained a DHCP lease from dnsmasq.
 
+@item @code{extra-options} (default: @code{'()})
+This option provides an ``escape hatch'' for the user to provide arbitrary
+command-line arguments to @command{dnsmasq} as a list of strings.
+
 @end table
 @end deftp
 
diff --git a/gnu/services/dns.scm b/gnu/services/dns.scm
index 6608046909..043c34599c 100644
--- a/gnu/services/dns.scm
+++ b/gnu/services/dns.scm
@@ -739,6 +739,8 @@ cache.size = 100 * MB
                     (default #t))       ;boolean
   (listen-addresses dnsmasq-configuration-listen-address
                     (default '()))      ;list of string
+  (extra-options    dnsmasq-configuration-extra-options
+                    (default '()))      ;list of string
   (resolv-file      dnsmasq-configuration-resolv-file
                     (default "/etc/resolv.conf")) ;string
   (no-resolv?       dnsmasq-configuration-no-resolv?
@@ -798,7 +800,7 @@ cache.size = 100 * MB
      tftp-single-port? tftp-secure?
      tftp-max tftp-mtu tftp-no-blocksize?
      tftp-lowercase? tftp-port-range
-     tftp-root tftp-unique-root)
+     tftp-root tftp-unique-root extra-options)
     (shepherd-service
      (provision '(dnsmasq))
      (requirement '(networking))
@@ -877,7 +879,8 @@ cache.size = 100 * MB
                         (if (> (length tftp-unique-root) 0)
                             (format #f "--tftp-unique-root=~a" tftp-unique-root)
                             (format #f "--tftp-unique-root")))
-                       '()))
+                       '())
+                #$@extra-options)
                #:pid-file "/run/dnsmasq.pid"))
      (stop #~(make-kill-destructor)))))