It is very similar to what I'm working on right now, except that in my case I have to force the DNS server to return different error messages than usual in order to place it on a private network.
I decided to just download the BIND source code and write my modifications as a patch for this. Then, for deployment, we can download the latest BIND source, which will include new security fixes, apply our patch for configuration, and build it.
I recommend that you do the same, just get a BIND and change it as needed. You can get BIND and all its documentation here at ISC.ORG .
Michael dillon
source share