untested but it should work

setup/static/render.js

@@ -83,4 +83,11 @@ $(document).ready(function() {
 			$("#ipv6").hide();
 		}
 	});
+	$("#unbound").change(function() {
+		if ($(this).is(":checked")) {
+			$("#unbound").hide();
+		} else {
+			$("#unbound").show();
+		}
+	});
 });

setup/templates/steps/compose/03_expose.html

@@ -40,13 +40,16 @@ avoid generic all-interfaces addresses like <code>0.0.0.0</code> or <code>::</co
   <input class="form-control" type="text" name="subnet6" required value="{{ subnet6 }}:beef::/64">
 </div>
 
-<p>The unbound resolver enables Mailu to do DNSSEC verification, DNS root lookups and caching. This also helps the antispam service not to get blocked by the public or ISP DNS servers.</p>
 <div class="form-check form-check-inline">
+  <p>The unbound resolver enables Mailu to do DNSSEC verification, DNS root lookups and caching. This also helps the antispam service not to get blocked by the public or ISP DNS servers.</p>
   <label class="form-check-label">
     <input class="form-check-input" type="checkbox" name="resolver_enabled" value="true" checked>
-    Enable unbound resolver
+    Enable an internal DNS resolver (unbound)
   </label>
 </div>
+<div class="form-group" id="unbound" style="display: none">
+	<p><span class="label label-danger">Read this:</span> Mailu requires a <b>validating, DNSSEC-enabled</b> DNS resolver</b> to function. Be sure to read our <a href="https://mailu.io/{{ version }}/faq.html#the-admin-container-won-t-start-and-its-log-says-critical-your-dns-resolver-isn-t-doing-dnssec-validation">FAQ entry</a> on the topic.</p>
+</div>
 
 <p>You server will be available under a main hostname but may expose multiple public
 hostnames. Every e-mail domain that points to this server must have one of the