Dnsmasq ignores queries from non local network

Refer to the DNSmasq documentation, especially the dnsmasq manpage and sample configuration file. The local keyword tells DNSmasq to perform those domain lookups with local data. This affects requests send to DNSmasq for foo.localnet and bar.localnet, for example. I don't think this is what you want.

# Add local-only domains here, queries in these domains are answered
# from /etc/hosts or DHCP only.
local=/localnet/

To force host/subdomain lookups to resolve to a specific address, you'd probably want to use the address keyword. The second example below should allow web1.devbox and web2.devbox and web73872.devbox to all resolve to the address specified.

# Add domains which you want to force to an IP address here.
# The example below send any host in doubleclick.net to a local
# webserver.
address=/doubleclick.net/127.0.0.1

# for your example
address=/devbox/192.168.3.99

I use DNSmasq at home to handle simple DNS stuff for my LAN; in that case, local and the associated domain and expand-hosts keywords are appropriate. The DNSmasq server is my primary nameserver, so all requests go through it; any nonlocal addresses are passed back to the ISP's nameserver. You might consider that configuration if possible.

You probably have dnsmasq's rebind protection enabled with this option:

   --stop-dns-rebind
          Reject (and log) addresses from upstream nameservers  which  are
          in  the private IP ranges. This blocks an attack where a browser
          behind a firewall  is  used  to  probe  machines  on  the  local
          network.

You can disable this entirely by removing this option, or you can whitelist certain domains using this option:

--rebind-domain-ok=example.com