diff --git a/dns/dnsmasq-devel/files/dnsmasq.in b/dns/dnsmasq-devel/files/dnsmasq.in
index bd62247f6694..1311df694b69 100644
--- a/dns/dnsmasq-devel/files/dnsmasq.in
+++ b/dns/dnsmasq-devel/files/dnsmasq.in
@@ -1,97 +1,109 @@
 #!/bin/sh
 
 # PROVIDE: dnsmasq
 # REQUIRE: SERVERS ldconfig
 # BEFORE:  DAEMON named
 # KEYWORD: shutdown
 #
 # Start before named so as not to break named_wait if named is
 # enabled and /etc/resolv.conf points to ourselves (dnsmasq).
 #
 #
 # Please add the following line to /etc/rc.conf.local or /etc/rc.conf to
 # enable the dnsmasq service(s):
 #
 # dnsmasq_enable (bool):  Set to "NO" by default.
 #                         Set it to "YES" to enable dnsmasq at boot.
 #
 # Further settings you can change in /etc/rc.conf if desired:
 #
 # dnsmasq_conf (path):    Set to %%PREFIX%%/etc/dnsmasq.conf by default.
 #                         Set it to another configuration file if you want.
 #
 # dnsmasq_flags (string): Empty by default. Set it to additional command
 #                         line arguments if desired.
 #
 # dnsmasq_restart (bool): Set to "YES" by default.
 #                         If "YES", a "reload" action will trigger a "restart"
 #                         if the configuration file has changed, to work
 #                         around a dnsmasq(8) limitation.
 #
 #
 # Additional actions supported by this script:
 #
 # reload        Reload database files by sending SIGHUP and SIGUSR2.
 #               However, if dnsmasq_restart is true (see above) and the
 #               configuration file has changed since this rc script has
 #               started dnsmasq, restart it instead.
 #
 # logstats      Dump statistics information to where dnsmasq is configured to
 #               log (syslog by default). This sends SIGUSR1 to dnsmasq.
 #
 
 . /etc/rc.subr
 
 name=dnsmasq
 rcvar=dnsmasq_enable
 
 command="%%PREFIX%%/sbin/${name}"
 pidfile="/var/run/${name}.pid"
 # timestamp (below) is used to check if "reload" should be a "restart" instead
 timestamp="/var/run/${name}.stamp"
 
 load_rc_config "${name}"
 
 : ${dnsmasq_enable="NO"}
 : ${dnsmasq_conf="%%PREFIX%%/etc/${name}.conf"}
 : ${dnsmasq_restart="YES"}
 
 command_args="-x $pidfile -C $dnsmasq_conf"
 
 required_files="${dnsmasq_conf}"
-extra_commands="reload logstats"
+extra_commands="reload logstats checkconfig"
 
 reload_precmd="reload_pre"
 reload_postcmd="reload_post"
+restart_precmd="checkconfig"
 start_postcmd="timestampconf"
-stop_precmd="rmtimestamp"
+stop_precmd="stop_pre"
 logstats_cmd="logstats"
+checkconfig_cmd="checkconfig"
 
 reload_pre() {
         if [ "$dnsmasq_conf" -nt "${timestamp}" ] ; then
                 if checkyesno dnsmasq_restart ; then
                         info "restart: $dnsmasq_conf changed"
                         exec "$0" restart
                 else
                         warn "restart required, $dnsmasq_conf changed"
                 fi
         fi
 }
 
 reload_post() {
         kill -USR2 ${rc_pid}
 }
 
 logstats() {
         kill -USR1 ${rc_pid}
 }
 
 timestampconf() {
         touch -r "${dnsmasq_conf}" "${timestamp}"
 }
 
 rmtimestamp() {
         rm -f "${timestamp}"
 }
 
+stop_pre() {
+        checkconfig || return
+        rmtimestamp
+}
+
+checkconfig() {
+        echo "Performing sanity check on ${name} configuration."
+        ${command} ${command_args} --test
+}
+
 run_rc_command "$1"
diff --git a/dns/dnsmasq/Makefile b/dns/dnsmasq/Makefile
index 89589552e859..522c420f55a5 100644
--- a/dns/dnsmasq/Makefile
+++ b/dns/dnsmasq/Makefile
@@ -1,143 +1,143 @@
 PORTNAME=	dnsmasq
 DISTVERSION=	2.90
 # Leave the PORTREVISION in even if 0 to avoid accidental PORTEPOCH bumps:
-PORTREVISION=	1
+PORTREVISION=	2
 PORTEPOCH=	1
 CATEGORIES=	dns
 MASTER_SITES=	https://www.thekelleys.org.uk/dnsmasq/ \
 		LOCAL/mandree/
 
 MAINTAINER=	mandree@FreeBSD.org
 COMMENT=	Lightweight DNS forwarder, DHCP, and TFTP server
 WWW=		https://www.thekelleys.org.uk/dnsmasq/doc.html
 
 LICENSE=	GPLv2
 
 USES=		cpe shebangfix tar:xz
 CPE_VENDOR=	thekelleys
 
 SHEBANG_FILES=	contrib/dnslist/dnslist.pl \
 		contrib/dynamic-dnsmasq/dynamic-dnsmasq.pl
 
 MAKE_ARGS=	CC="${CC}" \
 		CFLAGS="${CFLAGS}" \
 		COPTS="${CFLAGS}" \
 		LIBS="${LDFLAGS}" \
 		PREFIX="${PREFIX}" \
 		RPM_OPT_FLAGS="${CPPFLAGS}"
 CFLAGS+=	-Wall -Wno-unused-function -Wno-unused-parameter \
 		-Wno-unused-value -Wno-unused-variable
 CPPFLAGS+=	-I${LOCALBASE}/include
 
 CONFLICTS_INSTALL=	dnsmasq-devel
 
 PATCH_STRIP=	-p1
 SUB_FILES=	pkg-message
 
 PORTDOCS=	CHANGELOG CHANGELOG.archive FAQ doc.html setup.html
 
 OPTIONS_DEFINE=		DBUS DNSSEC DOCS IPSET IPV6 LUA
 OPTIONS_DEFAULT=	DNSSEC IPSET
 OPTIONS_RADIO=		INTL
 OPTIONS_RADIO_INTL=	IDN NLS
 OPTIONS_EXCLUDE+=	EXAMPLES
 
 DNSSEC_DESC=	Enable DNSSEC caching and validation (needs nettle)
 IDN_DESC=	IDN: Int'l Domain Names WITHOUT full NLS
 INTL_DESC=	Internationalization Support Level
 IPSET_DESC=	Dynamic firewall management of resolved names (needs PF)
 LUA_DESC=	Support lease-change scripts written in Lua
 NLS_DESC=	IDN+NLS: Int'l Domain Names & National Language support
 
 IPSET_CFLAGS_OFF=	-DNO_IPSET
 IPV6_CFLAGS_OFF=	-DNO_IPV6
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MNLS}
 USES+=		gettext gmake iconv pkgconfig
 CFLAGS+=	-DHAVE_LIBIDN2
 LIB_DEPENDS+=	libidn2.so:dns/libidn2
 PLIST_SUB+=	NLS=""
 ALL_TARGET=	all-i18n
 _intllibs=	-lidn2 -lintl
 .else
 _intllibs=
 PLIST_SUB+=	NLS="@comment "
 .if ${PORT_OPTIONS:MIDN}
 USES+=		iconv
 CFLAGS+=	-DHAVE_LIBIDN2
 LIB_DEPENDS+=	libidn2.so:dns/libidn2
 _intllibs+=	-lidn2
 .endif
 .endif
 
 .if ${PORT_OPTIONS:MDBUS}
 LIB_DEPENDS+=	libdbus-1.so:devel/dbus
 USES+=		pkgconfig
 CPPFLAGS+=	`pkg-config --cflags dbus-1`
 CFLAGS+=	-DHAVE_DBUS
 LDFLAGS+=	`pkg-config --libs dbus-1`
 .endif
 
 .if ${PORT_OPTIONS:MLUA}
 CPPFLAGS+=	-I${LUA_INCDIR}
 CFLAGS+=	-DHAVE_LUASCRIPT
 LDFLAGS+=	-L${LUA_LIBDIR} -llua-${LUA_VER}
 USES+=		lua pkgconfig
 .endif
 
 .if ${PORT_OPTIONS:MDNSSEC}
 CFLAGS+=	-DHAVE_DNSSEC -I${LOCALBASE}/include
 USES+=		pkgconfig
 LIB_DEPENDS+=	libgmp.so:math/gmp \
 		libnettle.so:security/nettle
 .endif
 
 USE_RC_SUBR=	dnsmasq
 
 .include <bsd.port.pre.mk>
 
 LDFLAGS+=	-L${LOCALBASE}/lib ${_intllibs} ${ICONV_LIB}
 
 post-patch:
 	${REINPLACE_CMD} -e '/^LUA /s/lua/lua-${LUA_VER}/' ${WRKSRC}/Makefile
 
 pre-configure: pretty-print-config
 .if ${PORT_OPTIONS:MIDN}
 .if empty(PORT_OPTIONS:MNLS)
 	@if ${READELF} -d ${LOCALBASE}/lib/libidn2.so \
 		| ${EGREP} -q '\<NEEDED\>.*\[libintl\.so' ; \
 	then ${ECHO} ; ${ECHO} 'WARNING: dns/libidn2 was compiled with NLS support!' ; \
 	${ECHO} 'Recompile libidn2 WITHOUT_NLS to get rid of NLS dependencies.' ; ${ECHO} ; \
 	fi
 .else
 	@${ECHO} 'WARNING: IDN and NLS enabled, building IDN WITH NLS.'
 .endif
 .endif
 
 do-install:
 	${INSTALL_PROGRAM} ${WRKSRC}/src/dnsmasq ${STAGEDIR}${PREFIX}/sbin
 	${INSTALL_DATA} ${WRKSRC}/dnsmasq.conf.example ${STAGEDIR}${PREFIX}/etc/dnsmasq.conf.sample
 	${REINPLACE_CMD} -i '' 's}%%PREFIX%%}${PREFIX}}' ${STAGEDIR}${PREFIX}/etc/dnsmasq.conf.sample
 	${INSTALL_MAN} ${WRKSRC}/man/${PORTNAME}.8 ${STAGEDIR}${PREFIX}/share/man/man8
 	${MKDIR} ${STAGEDIR}${DATADIR}
 	${INSTALL_DATA} ${WRKSRC}/trust-anchors.conf ${STAGEDIR}${DATADIR}/
 .if ${PORT_OPTIONS:MDOCS}
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	cd ${WRKSRC} && ${INSTALL_DATA} ${PORTDOCS} ${STAGEDIR}${DOCSDIR}
 .endif
 .if ${PORT_OPTIONS:MNLS}
 .for i in de es fi fr id it no pl pt_BR ro
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/locale/${i}/LC_MESSAGES
 	${INSTALL_DATA} ${WRKSRC}/src/${i}.mo \
 		${STAGEDIR}${PREFIX}/share/locale/${i}/LC_MESSAGES/${PORTNAME}.mo
 .endfor
 .endif
 	${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/dynamic-dnsmasq ${STAGEDIR}${EXAMPLESDIR}/dnslist
 	${INSTALL_SCRIPT} ${WRKSRC}/contrib/dynamic-dnsmasq/dynamic-dnsmasq.pl ${STAGEDIR}${EXAMPLESDIR}/dynamic-dnsmasq/
 	${INSTALL_SCRIPT} ${WRKSRC}/contrib/dnslist/dnslist.pl ${STAGEDIR}${EXAMPLESDIR}/dnslist/
 	${INSTALL_DATA} ${WRKSRC}/contrib/dnslist/dhcp.css ${STAGEDIR}${EXAMPLESDIR}/dnslist/
 	${INSTALL_DATA} ${WRKSRC}/contrib/dnslist/dnslist.tt2 ${STAGEDIR}${EXAMPLESDIR}/dnslist/
 
 .include <bsd.port.post.mk>
diff --git a/dns/dnsmasq/files/dnsmasq.in b/dns/dnsmasq/files/dnsmasq.in
index bd62247f6694..1311df694b69 100644
--- a/dns/dnsmasq/files/dnsmasq.in
+++ b/dns/dnsmasq/files/dnsmasq.in
@@ -1,97 +1,109 @@
 #!/bin/sh
 
 # PROVIDE: dnsmasq
 # REQUIRE: SERVERS ldconfig
 # BEFORE:  DAEMON named
 # KEYWORD: shutdown
 #
 # Start before named so as not to break named_wait if named is
 # enabled and /etc/resolv.conf points to ourselves (dnsmasq).
 #
 #
 # Please add the following line to /etc/rc.conf.local or /etc/rc.conf to
 # enable the dnsmasq service(s):
 #
 # dnsmasq_enable (bool):  Set to "NO" by default.
 #                         Set it to "YES" to enable dnsmasq at boot.
 #
 # Further settings you can change in /etc/rc.conf if desired:
 #
 # dnsmasq_conf (path):    Set to %%PREFIX%%/etc/dnsmasq.conf by default.
 #                         Set it to another configuration file if you want.
 #
 # dnsmasq_flags (string): Empty by default. Set it to additional command
 #                         line arguments if desired.
 #
 # dnsmasq_restart (bool): Set to "YES" by default.
 #                         If "YES", a "reload" action will trigger a "restart"
 #                         if the configuration file has changed, to work
 #                         around a dnsmasq(8) limitation.
 #
 #
 # Additional actions supported by this script:
 #
 # reload        Reload database files by sending SIGHUP and SIGUSR2.
 #               However, if dnsmasq_restart is true (see above) and the
 #               configuration file has changed since this rc script has
 #               started dnsmasq, restart it instead.
 #
 # logstats      Dump statistics information to where dnsmasq is configured to
 #               log (syslog by default). This sends SIGUSR1 to dnsmasq.
 #
 
 . /etc/rc.subr
 
 name=dnsmasq
 rcvar=dnsmasq_enable
 
 command="%%PREFIX%%/sbin/${name}"
 pidfile="/var/run/${name}.pid"
 # timestamp (below) is used to check if "reload" should be a "restart" instead
 timestamp="/var/run/${name}.stamp"
 
 load_rc_config "${name}"
 
 : ${dnsmasq_enable="NO"}
 : ${dnsmasq_conf="%%PREFIX%%/etc/${name}.conf"}
 : ${dnsmasq_restart="YES"}
 
 command_args="-x $pidfile -C $dnsmasq_conf"
 
 required_files="${dnsmasq_conf}"
-extra_commands="reload logstats"
+extra_commands="reload logstats checkconfig"
 
 reload_precmd="reload_pre"
 reload_postcmd="reload_post"
+restart_precmd="checkconfig"
 start_postcmd="timestampconf"
-stop_precmd="rmtimestamp"
+stop_precmd="stop_pre"
 logstats_cmd="logstats"
+checkconfig_cmd="checkconfig"
 
 reload_pre() {
         if [ "$dnsmasq_conf" -nt "${timestamp}" ] ; then
                 if checkyesno dnsmasq_restart ; then
                         info "restart: $dnsmasq_conf changed"
                         exec "$0" restart
                 else
                         warn "restart required, $dnsmasq_conf changed"
                 fi
         fi
 }
 
 reload_post() {
         kill -USR2 ${rc_pid}
 }
 
 logstats() {
         kill -USR1 ${rc_pid}
 }
 
 timestampconf() {
         touch -r "${dnsmasq_conf}" "${timestamp}"
 }
 
 rmtimestamp() {
         rm -f "${timestamp}"
 }
 
+stop_pre() {
+        checkconfig || return
+        rmtimestamp
+}
+
+checkconfig() {
+        echo "Performing sanity check on ${name} configuration."
+        ${command} ${command_args} --test
+}
+
 run_rc_command "$1"