"In order to speed up DNS lookups, I want to install a DNS cache or proxy."
Ok. But there's an easier way, too. Using OpenDNS and/or Google name servers will be faster than your own local cache for names that already exist in the OpenDNS/Google caches. Using 18.104.22.168, 22.214.171.124, and/or 126.96.36.199 as name serves will be faster almost all of the time. You can test this with
time nslookup www.google.com 188.8.131.52 to test speed on one of the OpenDNS name servers,
time nslookup www.google.com 184.108.40.206 for Google, or
time nslookup www.google.com 127.0.0.1 on your local cache. When I say faster, I mean technically faster and not so much faster that a person could easily notice a difference.
"I can see at least three programs I think will do the job: bind9, pdnsd, or dnsmasq."
Are you open to the dnscache portion of djbdns? Instructions below. Though, it does not save the cache without a patch...
sudo apt-get remove bind9 dnsmasq-base
sudo apt-get install djbdns dnscache-run
sudo killall -9 dnsmasq
sudo update-rc.d -f bind9 remove
Then we'll need to tell the system to use our cache.
sudo gedit /etc/resolv.conf
Edit the file to look like this example. This file defines which name servers to use, the default domain, and the search suffix. The search suffix makes it possible to run queries using only the hostname portion of a fully-qualified domain name. For exmaple, 'nslookup www' automagically becomes 'nslookup www.example.com' when example.com is the value of the "search" parameter.
nameserver 127.0.0.1 # Use the local resolver first.
nameserver 220.127.116.11 # OpenDNS
nameserver 18.104.22.168 # Google
This is a little fancy, but we need to get the lastest root name servers.
sudo dnsip $(dnsqr ns . | sed -e '/answer/!d;s/\(.*\)NS \(.*\)/\2/') | sudo tee /etc/dnscache/root/servers/@
I think the resolv.conf file is overwritten when we use DHCP. I choose to give myself a static IP address and remove the software that squashes it, editing the interfaces file to set up the static IP address. But you could try to work with Network Manager if you are so inclined.
sudo apt-get purge network-manager network-manager-gnome
sudo gedit /etc/network/interfaces
My interfaces file looks as follows, but modify yours to your configuration.
iface lo inet loopback
# First network card (attached to NAT router, attached to cable internet)
iface eth0 inet static
Now let's just restart.
Now you are using a local resolver and the latest root servers. But you'll notice if you try that OpenDNS and Google are in fact answering faster (for names that are in their caches, which is all of the most popular domains). There is no additional configuration that could cause the software to become any more secure that it already is.