diff --git a/package/network/services/dnsmasq/patches/120-nettle-3.0-compatibility.patch b/package/network/services/dnsmasq/patches/120-nettle-3.0-compatibility.patch
new file mode 100644
index 0000000000..2e5fc2ae34
--- /dev/null
+++ b/package/network/services/dnsmasq/patches/120-nettle-3.0-compatibility.patch
@@ -0,0 +1,29 @@
+--- a/src/dnssec.c
++++ b/src/dnssec.c
+@@ -20,7 +20,7 @@
+ #ifdef HAVE_DNSSEC
+ 
+ #include <nettle/rsa.h>
+-#include <nettle/dsa.h>
++#include <nettle/dsa-compat.h>
+ #ifndef NO_NETTLE_ECC
+ #  include <nettle/ecdsa.h>
+ #  include <nettle/ecc-curve.h>
+@@ -173,7 +173,7 @@ static int rsa_verify(struct blockdata *
+   return 0;
+ }  
+ 
+-static int dsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
++static int dnsmasq_dsa_verify(struct blockdata *key_data, unsigned int key_len, unsigned char *sig, size_t sig_len,
+ 		      unsigned char *digest, int algo)
+ {
+   unsigned char *p;
+@@ -296,7 +296,7 @@ static int verify(struct blockdata *key_
+       return rsa_verify(key_data, key_len, sig, sig_len, digest, algo);
+       
+     case 3: case 6: 
+-      return dsa_verify(key_data, key_len, sig, sig_len, digest, algo);
++      return dnsmasq_dsa_verify(key_data, key_len, sig, sig_len, digest, algo);
+  
+ #ifndef NO_NETTLE_ECC   
+     case 13: case 14: