Hmm - maybe it could also be fixed via service file dependencies. I see that dnsmasq.service orders itself after network.target and before nss-lookup.target. Is there anything else it could hook to that makes sure it doesn't get started until /etc/resolve.conf is actually there?