Alternative to Pihole's DNS Overrides?

[szethh]

Hi! I'm moving from Pihole to adguard home. I am trying to set up dns overrides, so that AGH can redirect a certain domain to an internal ip (my reverse proxy).

In pihole, I would do it like this:

# /etc/dnsmasq.d/03-dns-overrides.conf
address=/int.domain.net/192.168.50.44  # lan address
address=/int.domain.net/100.100.100.95  # tailscale address

So if you go to *.int.domain.net, pihole will redirect you first to the lan address (192...) and if you are not on lan then it will try via tailscale. Kinda like a fallback.

When looking at the adguard home docs, I found DNS rewrites and it seemed like my answer. However, I tried adding both my addresses but only the first one is applied. That is, when going to abc.int.domain.net, it only redirects to the lan address. Even if I'm not on lan, the second address is not tried and the domain does not resolve.

Here's the relevant part of my config file:

...
filtering:
  rewrites:
    - domain: '*.int.domain.net'
      answer: 192.168.50.44
    - domain: '*.int.domain.net'
      answer: 100.100.100.95

If I swap the order, and put the tailscale one on top, the domain only resolves while connected to my tailnet. Is there something I'm missing? How can I achieve the behavior of pihole/dnsmasq provide with dns overrides?