[zfa]

Well 'the alternatives' are many so there's no quick answer to this, but restricting to just AGH as per this post then...

Encrypted upstream lookups. Responding to encrypted lookups made to themselves. Realtime threat protection via API. Quick toggle of blocks instead of rebuilding lists. Ability to quickly change blocking of individual devices. Decent Metrics.

Probably more.

But if you just want something with no web bling then there's other alternatives to dnsmasq which would be worth looking at which give some of the above features whilst keeping it commandline and manual blocklist building.

dnscrypt-proxy is wonderful, for example, and can do most of the stuff you can do in dnsmasq.