I thought that might be your rationale, but figured I should ask anyway. And I'm not convinced it's correct.
Here's my reasoning:
You have one Kids interface in the Kids firewall zone, and one Adults interface in the Adults zone. Any adult device joining the kids network will be in the Kids firewall zone and subject to the Kids firewall policies. And vice-versa.
So, your firewall draws a distinction between the two networks. And so should your dnsmasq configuration.
I still think it'd be easier not to bother with attempts at segregation based on network, but instead use per-device policies in, say, something like Adguard Home or Pi-hole (I know, I know, I'll keep banging that drum...),
this is just one instance. you should use interface & notinterface complementary , ie:
for adult instance interface adult, notinterface kid, and vice versa. delete port option.
and then you can let clients to use the default dns (&dhcp) instance related to their network, or individually you can force it to use the other dns (but not the other dhcp) via dhcp option.
What's in the directories /tmp/adults_lan/dnsmasq.d/ and /tmp/kids_lan/dnsmasq.d/? Any chance something in either or both of those directories might also be getting in the way?
I don't think that is correct I have two instances both are listed in luci they are just not bound to specific one there are two seperate dhcp servers thts all working just not dns on any port other than 53.
my log might be missing the rest of the info because dawn logspams.
You can use full dnsmasq directives in files in those directories, which you might not be able to do in LuCI / UCI / /etc/config/dhcp. If you've got any directives in those directories which cause conflicts, that may also help to explain the issues your experiencing.
You've got both adults_lan and kids_lan interfaces defined in both dnsmasq instances (you explained why previously). Adult DNS listens on 53, and Kid DNS listens on 5153. But only 5153 is listening on both interfaces in your netstat output. Notice that 53 only appears on one interface, not both.
If the adults_dns dnsmasq instance listens on port 53, and that same instance is bound to bothadults_lan and kids_lan, then you should see 53 listening on both interfaces.
Whether that's desirable or not according to your goals is beside the point. Based on your apparent configuration, that's what should be happening. And it isn't, for some reason.
Your logread extract shows some potential issues with DHCP. So, here's a suggestion for a test: take DHCP out of the mix.
Configure a client with a static IP address and gateway in the Adult LAN, along with the Adult DNS server. Then see if DNS resolution (and blocking) works.
Then repeat the test, this time with a static IP address and gateway in the Kids LAN, along with the Kids DNS server.
For the avoidance of doubt, connect to the Adults AP / SSID for the Adult test, and connect to the Kids AP / SSID for the Kid test.
ok, that's what you did. but why you want both networks to use both dnsmasq instance?
you have adult and kid users so you want kid users to have filtered dns access (using adblock). so far ok.
you created two networks: two interfaces with different ip addresses and put them respective firewall zone. so far ok.
you created the two dnsmasq instances one with parental controlled adblock filtering. so far ok.
and your next step was to add both dnsmasq to both network which i don't get: why you don't keep using the separation of networks idea you used so far?