Since this question was asked, there have been changes in the DNS landscape worth mentioning. It seems the asker is seeking a DNS recursor. The options worth discussing are:
- unbound - A full featured yet still lightweight DNS resolver. Unbound is small, solid, and secure. It is the first 3rd party resolver to replace BIND in an OS release. It is highly recommended.
- dnscache - released as part of djbdns, it's the original lightweight DNS recursor. It's rock solid, doesn't leak memory, is very secure, and performs well. Drawbacks are a slightly unusual install, lack of DNSSEC, no support for multiple CPUs, and CNAME handling that fails under just enough circumstances to be a bother.
- PowerDNS Recursor - It's harder to call pdns lightweight. PowerDNS bills itself a "high performance" recursor and has a worse security record than dnscache and unbound. I don't have enough experience to comment further.
- BIND - It's not fair to call BIND lightweight, that's not its focus. BIND aims to be the maximal DNS server, supporting every DNS protocol on every OS. That often carries a penalty to be paid in performance, size and especially security.
The options for a lightweight authoritative DNS server are considerably broader now than in years past. Knot, NSD, tinydns, and Yadifa all have low-or-no security vulnerabilities (bonus points to tinydns since it has been released for so much longer), are very lightweight daemons. All 4 perform very well with each having particular esoteric strengths.
- Knot, NSD, Yadifa - All very lightweight, secure, and very, very fast. These three were each written to serve the TLDs (few zones, many records) but also work well for serving the more common ISP workload of many zones with a handful of records each.
- tinydns - highly secure and very fast. Supports DNSCurve (almost 0% adoption) and not DNSSEC (widespread and growing). Unusual install but extremely reliable in operation.
- PowerDNS - PowerDNS performs well enough. Like BIND, one would choose PowerDNS more for its feature set than its performance and security.
- BIND - as mentioned previously, is not lightweight.
Another requirement, is for the solution to be HA, meaning the DNS servers will sync the data between themselves. And last (preferred but not a must), is to have some simple web front-end for the whole stuff.
Only PowerDNS has a web interface "bundled" with the DNS server. For a web front-end to manage authoritative DNS, there are a number of options. NicTool is obviously my favorite, as it can be used with tinydns, BIND, Knot, NSD, Yadifa, or any combination thereof.