But what about IPv6 records or DKIM/SPF TXT entries?
It is hell to maintain more than a couple of these records for djbdns.
I had to use an online tool every time to help me convert my entries to tinydns format.
I switched to PowerDNS mainly for this reason.
I remember that djbdns had some other quirks too. Like I had to setup a supervisor to run it (no integration with the init system), I had to run one instance for IPv4, one for IPv6 and one for IPv4 zone transfers. Also it didn't support zone transfers over IPv6.
Maybe all these have been fixed, it is a couple years since I last used it.
I've written a library in Scheme to generate my tinydns configuration from a functional program. It includes error-checking, IPv6 and SPF support (haven't used DKIM yet). I might clean it up and publish it if there's interest.
I'll send you notification when done if you give me your email (you can contact me at the URL in my profile). (Or supposedly you could "watch" the Github repo above for similar effect.)
Edit: the functionality on Github to get notifications is "watch", not "star".
djbdns is a great read and exemplary code, but I wouldn't use it in production without significant modification; it's far too easy to DOS.
TinyDNS and dnscache can each be sped up by about a factor of two by replacing a few of a hand-rolled primitives with their SIMD equivalents, but even after that neither is terribly fast and it's very easy to exhaust their limits. axfrdns is deal-breaker slow; it forks a new process for each TCP connection.
axfrdns is a confusing mis-nomer; the daemon handles all TCP DNS queries too. TinyDNS will truncate any UDP response that doesn't fit in 500 bytes (it also doesn't implement EDNS0), leaving it to be handled by axfrdns. That's about 4% of all DNS responses going on my data.
To generalize my point; DOS is a very significant risk to DNS server availability these days, and the first and best defense is to have a fast server (Knot's target of 500k qps is in the right ballpark). djbdns is single threaded, single process and doesn't even use epoll/kqueue, it's just not up to it and tops out within a few 10k qps, axfrdns won't get close to that.
https://github.com/abh/djbdns/blob/master/byte_copy.c is a good example of my earlier point too; last time I profiled tinydns it spent a lot of time in vanity routines like that; the libc implementations are factored to CPU instructions and are much better.
No disagreement with your points about Bind though.
None of these are meaningful. BIND has a long and illustrious history of coughing up shells to attackers. Any nameserver written in C and not written by Bernstein has a high hurdle to clear.
DNSSEC, by the way, is a bug and not a feature.