Unbound can do authoritative dns. It is a bit clunky so usually what you do is have NSD for the authoritative parts and unbound for the recursive parts. but unbound has local-zone: stub-zone: forward-zone: auth-zone: directives. I am not the most sophisticated dns admin but I am fairly sure that just unbound by itself can do almost any dns party trick you care to throw at it.

I think that is the "challenge" with dnsmasq. In addition to caching DNS it also does, dhcp, authoritative DNS, BOOTP and TFTP.