I was done with all companies sleuthing information (this includes your DNS requests when they can!)
I wanted to be able to use DNSSEC and DANE
Without losing the dynamic DHCP/DNS capability from dnsmasq

1. dnsmasq for DHCP and dynamic DNS
2. Unbound as validating, caching and recursive DNS resolver

There were 2 ways of doing this

1. Make dnsmasq the primary DNS server on my LAN and use Unbound as the recursive resolver
2. Make Unbound the primary DNS server on my LAN and make it use dnsmasq for my LAN (and domains)

I chose 2 assuming that Unbound is more geared towards performance and security than dnsmasq is

This was amazingly simple to do, but Unbound is a bit daunting with the amount of features it has. I've boiled it down to

server:
        verbosity: 1
        num-threads: 1
        interface: 192.0.2.1
        access-control: 192.0.2.1/24 allow
        chroot: "/usr/local/etc/unbound"
        username: "unbound"
        directory: "/usr/local/etc/unbound"
        use-syslog: yes
        pidfile: "/var/run/unbound/unbound.pid"
 
        # Tune for lower memory usage
        outgoing-num-tcp: 1
        incoming-num-tcp: 1
        outgoing-range: 60
        msg-buffer-size: 8192
        msg-cache-size: 100k
        msg-cache-slabs: 1
        rrset-cache-size: 100k
        rrset-cache-slabs: 1
        infra-cache-numhosts: 1000
        infra-cache-slabs: 1
        key-cache-size: 100k
        key-cache-slabs: 1
        neg-cache-size: 10k
        num-queries-per-thread: 30
        target-fetch-policy: "2 1 0 0 0 0"
 
        hide-identity: yes
        hide-version: yes
        harden-short-bufsize: yes
        harden-large-queries: yes
        harden-glue: yes
        harden-dnssec-stripped: yes
        harden-below-nxdomain: yes
 
        private-address: 192.0.2.0/24
        private-domain: "example.net"
        private-domain: "example.org"
        do-not-query-localhost: yes
 
        module-config: "validator iterator"
        auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
        dlv-anchor-file: "dlv.isc.org.key"
 
        val-clean-additional: yes
        local-zone: "0.192.in-addr.arpa." nodefault
        unblock-lan-zones: yes
 
stub-zone:
        name: "example.net"
        stub-addr: 192.0.2.1@5353
 
stub-zone:
        name: "example.org"
        stub-addr: 192.0.2.1@5353

1. pidfile: “/var/run/unbound/unbound.pid”

The default config is for the pid-file to be in /usr/local/etc/unbound which is not as per hier(7) and as per Unbound's documentation not required to be inside the chroot.

mkdir -p /var/run/unbound
chown unbound /var/run/unbound

1. interface: 192.168.100.1
2. stub-addr: 192.0.2.0@5353

Unbound listens on the default dns port, dnsmasq on port 5353

domain-needed
bogus-priv
expand-hosts
 
no-resolv
 
listen-address=192.0.2.1
port=5353
 
domain=example.net,192.0.2.0/24,local
domain=example.org,192.0.2.0/24,local
 
dhcp-range=192.0.2.100,192.0.2.199,255.255.255.0,24h
dhcp-range=::,constructor:em0, ra-stateless, ra-names
 
dhcp-host=somehost
dhcp-host=anotherhost
 
dhcp-option=option:router,192.0.2.254
dhcp-option=option:dns-server,192.0.2.1
dhcp-option=option:ntp-server,192.0.2.1
dhcp-option=option:domain-search,example.org,example.net
dhcp-option=54,192.0.2.1      # DHCP Server Id
 
dhcp-option=option6:dns-server,[::]
dhcp-option=option6:information-refresh-time,6h
 
dhcp-option=19,0           # option ip-forwarding off
dhcp-option=44,192.0.2.1   # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
dhcp-option=45,0.0.0.0     # netbios datagram distribution server
dhcp-option=46,8           # netbios node type
dhcp-option=252,"\n"       # please Windows 7
 
mx-target=smtp.example.org
localmx
selfmx
 
srv-host=_ldap._tcp.example.org,example.org,389

1. Give fixed IP-address to host defined in /etc/hosts