How to set message for agent when emails coming from restricted country

Content

HI,
We have requirement that system should display message to Agent when incident/contact emails coming from some restricted country.
Client dont do business in some countries and they want agent should be alerted when emails do come from such countries.
We have list of domains from such countries.
I tried to create rule for contact with contact create/updated by utility and where primary emails like domain from restricted country, it will set one custom flag (restricted country) to yes.
I have created a workspace rule which will check if this flag is set to Yes, it will display message on Incident opening.