I"m leaning towards #dnsmasq
Do you really want to use software distributed via unauthenticated channels (looks like it isn't anymore)? I suggested the authors years ago and he flat out said he did didn't want to and didn't see any value in using https.
I don't trust people who have that attitude about security to write software that I run.
If you download a source dist, it looks like you can get it via https now, pretty sure that wasn't the case years ago.
But, if you clone the code, the recommended ways are both insecure.
But luckily, it looks like the git version I'm running doesn't allow either insecure protocol:
fatal: transport 'git' not allowed
and:
fatal: transport 'http' not allowed
$ sudo apt install dnsmasq. I didn't attempt to manually compile from source.