[FR] Preserve EDE information from upstream

[Skyb0rg007]

Current behavior
If unbound forwards queries to a different resolver with a forward-zone, responses may contain Extended DNS Errors with the responses.

One concrete example is with Malware/Adult/Gambling filters:

$ # Example query (replace adult.example.com with your favorite blocked site)
$ # Notice the 'EDE: 17 (Filtered)'
$ dig @2606:4700:4700::1113 adult.example.com
; <<>> DiG 9.20.24 <<>> @2606:4700:4700::1113 adult.example.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13550
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 17 (Filtered)
; PADDING: (390 bytes)
;; QUESTION SECTION:
;adult.example.com.			IN	AAAA

;; ANSWER SECTION:
adult.example.com.		60	IN	AAAA	::

;; Query time: 31 msec
;; SERVER: 2606:4700:4700::1113#53(2606:4700:4700::1113) (UDP)
;; WHEN: Sun Aug 09 12:49:11 CDT 2026
;; MSG SIZE  rcvd: 74

$ # Now trying with unbound
$ # Notice: no 'EDE'
$ cat unbound.conf
server:
   # ...
   ede: yes
forward-zone:
    name: "."
    forward-addr: 2606:4700:4700::1113

$ dig @::1 -p 8053 adult.example.com AAAA

; <<>> DiG 9.20.24 <<>> @::1 -p 8053 adult.example.com AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48558
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;adult.example.com.			IN	AAAA

;; ANSWER SECTION:
adult.example.com.		60	IN	AAAA	::

;; Query time: 53 msec
;; SERVER: ::1#8053(::1) (UDP)
;; WHEN: Sun Aug 09 12:51:21 CDT 2026
;; MSG SIZE  rcvd: 68

Describe the desired feature
Unbound should propagate certain Extended DNS Errors received from forward-zones.
The list of EDEs should at least include 4, 15, 16, 17: Forged, Blocked, Censored, and Filtered respectively.

Potential use-case
When a user attempts to visit a website that resolves to 0.0.0.0, the browser's error page can give a reason why the page is not shown.

Right now the error message is simply "Firefox can’t connect to the server at adult.example.com".
With EDE support, this message could also include something like "you have requested to filter this domain" (Filtered) or "due to security policy, this domain is on a blocklist" (Blocked).