I recommend djbdns.

You recommend something that hasn't been maintained in over a decade. Something that needs all sorts of random patches to still be useful? Random patches that may or may not introduce random vulnerabilities?

BIND may have had a (really) bad run in the BIND 8 days, but BIND 9 was surely an improvement.

And if you really want to stay away from BIND, you can go for something like PowerDNS. Or a combination like PowerDNS+Unbound.

I'm not sure what patches you're saying are required. Most startups don't need much more than what comes in the box. What's crazy to me is the idea that they'd opt into BIND 9 preemptively, not knowing what their extended needs are.

This is, for what it's worth, the original objection to qmail as well --- "it's not even maintained". It's not maintained because for the core job it does, it's _correct_. There's not a lot of mail software (at least, not software written in C) that can make a competing claim.

Having been through djbware patch hell, I tend to agree, but did he not finally actually open source his software (both qmail and djbdns)?

Has that addressed the patchiness blechery?

On rare occasion, someone actually finishes a program. Just because there aren't a mad rush of patches doesn't mean that a program is not up to snuff.

Best and defacto do not necessarily coincide. BIND is just one of those classics that have been around forever and have huge momentum behind them. BIND also powers many of the root servers afaik which gives it some extra credibility. But what is best for root servers might not be best for your average personal/small-business/startup use.

No, it isn't /that/ bad underneath.

But bind is a fairly big and complex code base. Which is probably also tied to why people use it - it's got the features people need (and a _huge_ community and install base.)