Use nsd. If you just run an authoritative only service, it is easy to do correctly.