diff --git a/main/dnsmasq/APKBUILD b/main/dnsmasq/APKBUILD
index 38a1a1dfeed201ec17e799599f08c1b860f024da..4e2c17b1c89f464b6330f23a43334b07468e9b43 100644
--- a/main/dnsmasq/APKBUILD
+++ b/main/dnsmasq/APKBUILD
@@ -13,18 +13,22 @@ makedepends="
 	dbus-dev
 	linux-headers
 	nettle-dev
+	nftables-dev
 	"
 install="
 	$pkgname.pre-install
 	$pkgname.pre-upgrade
 	$pkgname-dnssec.pre-install
 	$pkgname-dnssec.pre-upgrade
+	$pkgname-dnssec-nftset.pre-install
+	$pkgname-dnssec-nftset.pre-upgrade
 	$pkgname-dnssec-dbus.pre-install
 	$pkgname-dnssec-dbus.pre-upgrade
 	"
 subpackages="
 	$pkgname-doc
 	$pkgname-dnssec
+	$pkgname-dnssec-nftset
 	$pkgname-dnssec-dbus
 	$pkgname-openrc
 	$pkgname-common::noarch
@@ -78,6 +82,9 @@ build() {
 	make LDFLAGS="$LDFLAGS" CFLAGS="$CFLAGS" COPTS="-DHAVE_DNSSEC" all
 	mv src/dnsmasq src/dnsmasq~dnssec
 
+	make LDFLAGS="$LDFLAGS" CFLAGS="$CFLAGS" COPTS="-DHAVE_DNSSEC -DHAVE_NFTSET" all
+	mv src/dnsmasq src/dnsmasq~nftset
+
 	make LDFLAGS="$LDFLAGS" CFLAGS="$CFLAGS" COPTS="-DHAVE_DNSSEC -DHAVE_DBUS" all
 	mv src/dnsmasq src/dnsmasq~dbus
 
@@ -94,7 +101,7 @@ check() {
 }
 
 package() {
-	provider_priority=100  # highest (other providers are dnsmasq-dnssec, dnsmasq-dnssec-dbus)
+	provider_priority=100  # highest (other providers are dnsmasq-dnssec, dnsmasq-dnssec-nftset, dnsmasq-dnssec-dbus)
 
 	make PREFIX=/usr DESTDIR="$pkgdir" install
 
@@ -105,11 +112,23 @@ package() {
 dnssec() {
 	pkgdesc="$pkgdesc with DNSSEC support"
 	provides="$pkgname=$pkgver-r$pkgrel"
-	provider_priority=20  # middle (other providers are dnsmasq, dnsmasq-dnssec-dbus)
+	provider_priority=20  # middle (other providers are dnsmasq, dnsmasq-dnssec-nftset, dnsmasq-dnssec-dbus)
 
 	install -D -m 755 "$builddir"/src/dnsmasq~dnssec "$subpkgdir"/usr/sbin/dnsmasq
 }
 
+nftset() {
+	pkgdesc="$pkgdesc with DNSSEC and nftables set support"
+	provides="
+		$pkgname=$pkgver-r$pkgrel
+		$pkgname-dnssec=$pkgver-r$pkgrel
+		"
+	provider_priority=15  # lower (other providers are dnsmasq, dnsmasq-dnssec, dnsmasq-dnssec-nftset)
+
+	cd "$builddir"
+	install -D -m755 src/dnsmasq~nftset "$subpkgdir"/usr/sbin/dnsmasq
+}
+
 dbus() {
 	pkgdesc="$pkgdesc with DNSSEC and D-Bus support"
 	provides="
@@ -117,7 +136,7 @@ dbus() {
 		$pkgname-dbus=$pkgver-r$pkgrel
 		$pkgname-dnssec=$pkgver-r$pkgrel
 		"
-	provider_priority=10  # lowest (other providers are dnsmasq, dnsmasq-dnssec)
+	provider_priority=10  # lowest (other providers are dnsmasq, dnsmasq-dnssec, dnsmasq-dnssec-nftset)
 
 	cd "$builddir"
 	install -D -m755 src/dnsmasq~dbus "$subpkgdir"/usr/sbin/dnsmasq
diff --git a/main/dnsmasq/dnsmasq-dnssec-nftset.pre-install b/main/dnsmasq/dnsmasq-dnssec-nftset.pre-install
new file mode 120000
index 0000000000000000000000000000000000000000..b456897a9add1bb222665a4f7958d8547cf9da87
--- /dev/null
+++ b/main/dnsmasq/dnsmasq-dnssec-nftset.pre-install
@@ -0,0 +1 @@
+dnsmasq.pre-install
\ No newline at end of file
diff --git a/main/dnsmasq/dnsmasq-dnssec-nftset.pre-upgrade b/main/dnsmasq/dnsmasq-dnssec-nftset.pre-upgrade
new file mode 120000
index 0000000000000000000000000000000000000000..b456897a9add1bb222665a4f7958d8547cf9da87
--- /dev/null
+++ b/main/dnsmasq/dnsmasq-dnssec-nftset.pre-upgrade
@@ -0,0 +1 @@
+dnsmasq.pre-install
\ No newline at end of file