I tried BIND, Dnsmasq, unbound, adguard. At the end I picked CoreDNS outside kubernetes. It can do everything (including wildcards and ACL), requires few resources and easy to configure.