> If I were running a DNS server that was being used by the public, or that was being used by downstream DNS servers, that would be different.

Without cooperation of the device, that is indistinguishable from that of a bad actor.

You can get what you want by owning the device and requiring it to cooperate (ie with controlled software or a certificate to allow monitoring / blocking).