1st Missing Element

I had to add two things to my dnsmasq configuration on the aux routers in the file /etc/config/dhcp:

    list server '10.0.1.1'# Clients will still get 10.0.3.1 as dns server
    list rebind_domain 'subdomain.site.com' # Allow rebind to web server

The list server makes dnsmasq forward dns queries to the server at 10.0.1.1 (the main router dnsmasq server). The list rebind_domain allows rebinding for specific sites such that dns rebinding protection can be left on. Thank you "jow" here. Another option is to completely disabled dns rebinding protection. Alternatively, it might be possible to use option rebind_localhost 1, but I did not test this. Without this step, I could not ping subdomain.site.com.

2nd Missing Element

Add the following entry to /etc/dnsmasq.conf on the main router.

address=/.site.com/10.0.1.4

Note the placeholder . for any subdomains. This change might also be possible in /etc/config/dhcp, but I am not sure how.

Original 2nd Missing Element (limited)

This was my original solution, which I have since abandoned. I added an entry (10.0.1.4 subdomain.site.com) into the /etc/hosts file of the main router, which has the limitation that there are no placeholders for subdomains or extended URLs like when using webdav.

127.0.0.1 localhost

::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.0.1.4 subdomain.site.com

Test this by adding logqueries 1 to /etc/config/dhcp to log all DNS queries. Something like the following will be shown, which indicates that /etc/hosts was the source:

Fri Jan  5 14:11:20 2018 daemon.info dnsmasq[7368]: 73 10.0.3.149/64299 /etc/hosts subdomain.site.com is 10.0.1.4

What did not work

It surprised me that the following /etc/config/dhcp configuration on the main router only worked within the 10.0.1.X/24 subnet:

config domain
        option name 'site.com'
        option ip '10.0.1.4'

config domain
        option name 'subdomain.site.com'
        option ip '10.0.1.4'

If anybody can shed light on this, I'd love to know why! Perhaps a problem?

It would seem that adding option dns 10.0.1.1 to /etc/config/network on aux routers did not really help my situation either.

config interface 'lan'
        option ifname  'eth0.1'
        option force_link '1'
        option type    'bridge'
        option proto   'static'
        option ipaddr  '10.0.2.1'
        option netmask '255.255.255.0'
        option dns     '10.0.1.1'

config interface 'wan'
        option ifname 'eth0.2' # Comment this out if connecting as sta using wlan
        option proto   'dhcp'
        option netmask '255.255.255.0'
        option gateway '10.0.1.1'
        option dns     '10.0.1.1'

Adding this option makes an entry show up in cat /tmp/resolv.conf.auto. However, list server 10.0.1.1, as explained above, adds nameserver 10.0.1.1 for the WAN interface.

Adding dhcp_options to /etc/config/dhcp on aux routers did not help.

config dhcp 'lan'
        option interface 'lan'
        option start '100'
        option limit '150'
        option leasetime '72h'
        option ra 'server'
        #list 'dhcp_option' '3,10.0.1.1' # SET DEFAULT GATEWAY, CAUTION CAN BREAK STUFF
        #list 'dhcp_option' '6,10.0.1.1' # SEND DNS SERVER ADDR TO CLIENTS, CAUTION CAN BREAK STUFF