Unbound with Tailscale’s split DNS has been solid for me. I use it as an OPNsense service with the web GUI, but the standalone YAML config looks simple enough.