The names region of /etc/hosts is written by mesh-wireguard and dnsmasq answers from it, but read it once at start: after the mesh stopped publishing public names (hq ADR 0191) every machine's hosts file was right and every resolver still answered mail.novox.be with a tunnel address. The config comment that says so changes the file, which restarts dnsmasq once everywhere.