So what we need is a DNS service that takes in all of the DNS record updates per normal DNS replication and flags these CNAME record entries into an easily consumable blocklist.
DNS-based filtering will be useless once DNS-over-HTTPS and pinned certificates are the norm. That will come to embedded devices first, but it'll come to consumer OS's too.
