Been trying to do exactly that.
And it's genuenly ass. x.x At least, for what I need.
Case in point: https://gist.github.com/IngwiePhoenix/b228996676cfc3b52fe22d707a959aa5
I think I need to put another resolver behind coreDNS...or infront?
Honestly, I have no idea. Looking at sdns, powerdns, unbound and friends.