Consider porting dnscrypt-proxy's blocked_ip feature to dnsproxy.

[pscoem]

https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-blocked-ips.txt

When enabled, it returns "a:0.0.0.0 / aaaa::0" back to the client when the resolved IP falls into specified range.

YAML example:

block_ip: true
  block_ip_file: path/to/ip-cidrs.txt