The usual suspect, BIND, has a feature called Response Policy Zones that can serve different responses to different ACL matches (such as source IP). It can even autogenerate the modified records if you ask it politely.
Of course a screwdriver also has a feature called Quick Eyeball Removal which may be preferable. That or I'm just bitter about having done this :).
I run coredns as internal dns and the advice for this solution from them is to run another coredns and solve it in config management. While not a pleasing answer its probably the easiest thing to do. Someone did write a plugin but it requires a fork to get some hooks and that was declined its PR.
Of course a screwdriver also has a feature called Quick Eyeball Removal which may be preferable. That or I'm just bitter about having done this :).