You might look at building a custom iPXE image with an embedded ipxe script that chainloads whatever you want to see after netbooting (e.g., menu.c32, vesamenu.c32, pxelinux, etc.). The nice thing is that iPXE doesn't need any passed DHCP options at all (e.g., options 66 and 67). What's embedded in the ipxe script will be used instead. It just needs DHCP to assign an IP.
The potential downside to this approach is that you either need to boot off a CD (you can create an ipxe image ISO), mount the ISO inside a VM to boot from it, or, if you do have an existing PXE boot server and are using something like pxelinux and menu.c32/vesamenu.c32 you can put an UNDI image that the ipxe build process will generate. The UNDI version of ipxe can be chain booted from pxelinux and perhaps from other boot loaders.
I'm still trying to figure out how to use dnsmasq as a proxyDHCP server myself. I can get it to boot the ipxe image via proxyDHCP but can't get ipxe to get a DHCP IP address after it loads. From I can tell it's because the iPXE DHCP client is preferring the proxyDHCP as its DHCP server (if that makes sense), which seems odd given what the purpose of the proxyDHCP server is - i.e., to NOT need a DHCP server.
EDIT: Here's a functional proxydhcp setup for dnsmasq (finally figured it out):
In /etc/dnsmasq.d/proxydhcp.conf file included from the main /etc/dnsmasq.conf config (e.g., config line conf-dir=/etc/dnsmasq.d):
pxe-service=net:#ipxe,x86PC,"My Cool Netboot Processes",ipxe-native
Works nicely with another DHCP server in the network. My VMs boot picking up the proxyDHCP options passed to the DHCP client instead however I assume (perhaps incorrectly?) that the client WILL pick any PXE-related boot options (e.g., 66, 67) up from a DHCP server if it's already configured to provide those options.
Note the use of all RFC1918 IP space in the proxy statements. There doesn't seem to be any issue doing this - i.e., no visible interference with an existing DHCP server because of course this is merely a proxy not an authoritative DHCP server for a subnet. Also the ipxe options are not specifically required to support proxydhcp but just an example based on how I'm choosing to use it; i.e., use proxydhcp to pass ipxe bootstrap information along.
In short, proxyDHCP is a very nice way to non-invasively implement PXE netbooting in environments where you are not technically or administratively capable of modifying the DHCP server(s) running in your environment.