diff --git a/roles/svc-net-tor/templates/dnsmasq-tor-onion.conf.j2 b/roles/svc-net-tor/templates/dnsmasq-tor-onion.conf.j2
index 79b268ab02..d001608461 100644
--- a/roles/svc-net-tor/templates/dnsmasq-tor-onion.conf.j2
+++ b/roles/svc-net-tor/templates/dnsmasq-tor-onion.conf.j2
@@ -3,8 +3,8 @@ listen-address=127.0.0.1
 {% if TOR_CONTAINER_DNS_HOST | length > 0 %}
 listen-address={{ TOR_CONTAINER_DNS_HOST }}
 {% endif %}
-{% endif %}
 bind-dynamic
+{% endif %}
 no-hosts
 no-resolv
 filter-AAAA
diff --git a/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py b/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py
index 222779d17a..d92a79fa7a 100644
--- a/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py
+++ b/tests/integration/roles/svc-net-tor/test_container_dns_wiring.py
@@ -38,6 +38,13 @@ class TestDnsmasqListeners(unittest.TestCase):
         self.assertIn("listen-address=127.0.0.1", rendered)
         self.assertNotIn("listen-address=172.17", rendered)
 
+    def test_no_bind_policy_when_the_listener_is_not_ours(self):
+        rendered = _render_dnsmasq(
+            TOR_DNSMASQ_OWNS_LISTENER=False, TOR_CONTAINER_DNS_HOST=""
+        )
+        self.assertNotIn("bind-dynamic", rendered)
+        self.assertNotIn("listen-address", rendered)
+
     def test_onion_queries_go_to_the_tor_resolver(self):
         self.assertIn("server=/onion/127.0.0.1#9053", _render_dnsmasq())