"As we gear up for the release of PowerDNS Recursor 4.0.0, we are doing a
series posts describing new cool features which you can try out today. Many
deployments are already running with 4.x alphas or snapshots, and now is a
great time to familiarize yourself with the new and upcoming possibilities.
In this post, we’ll explain how to efficiently use the PowerDNS Recursor to
optionally block certain domains for some or all of your users. This could
be to stop users being tracked, to block advertisements or to protect
against malware. The simple scripts below scale to millions of domain names
and millions of users, all with acceptable startup times (seconds)."
As the post notes at the end, you can make this far more advanced, including
consulting customer & domain status databases in realtime (asynchronously).