DNS needs a way to say “unavailable for legal reasons” so your system just picks a different resolver or resolves recursively.

As far as I know there is no way to reliably:

- let the user see this error. The client would need to surface the DNS EDE error. Stub resolvers and browsers overwhelmingly ignore EDE.

- geo-fence the client. Unbound does not have native Geo support and will not let one set custom per-zone EDE text even if that was a thing AFAIK.

This might be possible by putting dnsdist in front of Unbound with client IP rules + Lua + MaxMind but there again the client won't know what to do with this.

- custom views only trigger off client IP's and only control resolution views, not error messages.

I think it's probably best that if people wish to run their own DNS instances, they do not geo-block anything. France has no jurisdiction in other countries and can't really do anything to "Alice and Bob's Public DNS". It's up to the people in France to find a way to tunnel their traffic out of their country to bypass any border filters should that ever become a thing. I am still waiting for a lawyer to challenge my thinking on this part.