feature: road-warrior clients resolve the domains of the new setting p2s.dns_domains with the router's resolver.

README.md

@@ -115,6 +115,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below |
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
+| `p2s` | `dns_domains` | list | | The domains road-warrior clients resolve with the router's resolver (INTERNAL_DNS_DOMAIN, RFC 8598, and the match domains of the Apple VPN profile), at most 16 |
 | `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
 | `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
@@ -788,7 +789,10 @@ that sets up road-warrior access in the built-in VPN client of macOS, iOS and iP
   the profile is installed, and the router does not keep it;
 - an IKEv2 VPN to `wan.local_fqdn`, with the user name as the local identity, the certificate over
   EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's road-warrior
-  connection takes them.
+  connection takes them;
+- with `p2s.dns_domains`, the router's resolver for those domains and their subdomains
+  (`SupplementalMatchDomains`). macOS and iOS use the DNS server of a VPN that does not carry all
+  traffic only for its match domains.
 
 The password is 8 to 128 characters. A user asking for the own profile also gives the current
 password and, when enrolled, a code.